On October 21, PHP released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both let an attacker run code on a web server without logging in. They affect PHP 5.4 through 8.5.11 and are rated CVSS 9.2. Details leaked the ...
Read
