infoq.com/news/2026/10/php-critical-rce-patches PHP Patches Two Critical RCE Flaws That Were Already Under Attack
PHP issued emergency releases on October 21 fixing two critical unauthenticated remote code execution flaws (CVE-2026-109618 and CVE-2026-109619), with Amazon reporting an exploitation attempt from October 17. Disclosure leaked early, patches arrived unevenly across distros, and public exploits reportedly fail against default installs.
— via InfoQ, Steef-Jan Wiggers
