PHP RCE (CVE-2026-109618 & CVE-2026-109619): what broke, who is exposed, and how to fix it today
Two critical PHP flaws allow unauthenticated remote code execution. Patched in 8.5.12, 8.4.27, 8.3.36, 8.2.35. Check your servers in one command.