Hello,Today (21 October 2026) the PHP project released an emergency security update fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. These flaws can allow unauthenticated remote code execution (RCE) and affect all PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, ...