On October 21, PHP released fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0) that can allow remote code execution without a login. Every PHP install serving web pages is in scope, and the PHP security team rates Apache mod_php as the most exposed, with a demonstrated exploit.