VULNERABILITYLatest from ITPro
Fixes issued for critical PHP vulnerabilities
An update has been issued for two critical PHP (PHP Hypertext Preprocessor) vulnerabilities after a working exploit was published online this week. PHP is a server-side programming language used in web development, powering millions of websites globally. The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and carry a CVSS score of 9.2, ranking them as ‘critical’. Both enable unauthenticated remote code execution (RCE), according to analysis.
Sources
- Latest from ITPro · 21-Oct-2026