SlowMist issued a security alert after PHP published a security notice on Oct. 20 disclosing two severe vulnerabilities that could lead to remote code execution. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both carry a CVSS v4 score of 9.2. PHP has not yet released a fix, and the affected versions as well as the exact exploitation conditions have not been confirmed.
Based on currently available information, PHP plans to release a security update at 14:00 UTC on Oct. 21, which is 22:00 Beijing time. SlowMist urged relevant organizations to review PHP versions running on servers and business systems as soon as possible, with particular attention on internet-exposed PHP services. It also advised teams to apply the update promptly once the patch is available. For systems that cannot be upgraded immediately, SlowMist recommended restricting access sources and, if necessary, adopting isolation measures.
SlowMist said in a security alert that PHP published a security notice on Oct. 20 disclosing two severe vulnerabilities that may lead to remote code execution, or RCE. The issues are listed as CVE-2026-109618 and CVE-2026-109619, and both received a CVSS v4 score of 9.2.
PHP has not released a patch yet. The specific affected versions and the conditions required for exploitation are still being confirmed. Based on the information currently available, PHP plans to publish a security update at 14:00 UTC on Oct. 21, or 22:00 Beijing time.
SlowMist advised relevant organizations to check the PHP versions used across servers and business systems as soon as possible, with a focus on PHP services exposed to the public internet. It also said systems should be upgraded promptly after the patch is released. For environments that cannot be updated right away, access sources should be restricted, and isolation measures should be taken if necessary.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
