Critical PHP Flaws Rated CVSS 9.2 Face Attacks Before Patch
Image
Global – October 29, 2026 -- Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS score of 9.2 and let unauthenticated attackers run code on web servers. Cyber insurer Coalition says its honeypots recorded exploit-related requests more than five hours before PHP released its fix, and it expects exploitation at scale.
PHP published its advisory on October 21, a day earlier than planned after details leaked online. The flaws sit in PHP itself rather than in any single application. Attackers can also read passwords, authentication tokens, API keys and certificates from server memory without taking over the server.