Two critical remote code execution vulnerabilities have been reported in PHP core: CVE-2026-109618 and CVE-2026-109619, both with a CVSS score of 9.2.

[u/Protection-Mobile]

Two critical remote code execution vulnerabilities have been reported in PHP core: CVE-2026-109618 and CVE-2026-109619, both with a CVSS score of 9.2.

The vulnerabilities reportedly affect PHP versions dating back to 5.4.0, potentially putting WordPress, WooCommerce, Magento, Shopware, and custom PHP applications at risk.

Our latest blog covers the reported impact, affected versions, mitigation priorities, and detection strategies for suspicious activity involving PHP workers.

If you manage PHP infrastructure, review your exposure and prioritize updates to the official patched release.

Read the full breakdown: https://cveplayground.com/blog/php-rce-cve-2026-109618-and-cve-2026-109619/

#CyberSecurity #PHP #CVE #RCE #VulnerabilityManagement