PHP critical vulnerabilities: what security teams should know

PHP released fixes addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4, each of which can lead to unauthenticated remote code execution. The vulnerabilities are in the PHP runtime itself rather than in a specific application; web environments such as PHP-FPM and Apache mod_php are affected. Calif first discovered them, Wiz independently discovered them several weeks later, and OpenAI and others participated in coordinated disclosure.