PHP ships emergency fixes for two critical unauthenticated RCE flaws

On October 21, 2026, PHP shipped emergency fixes for CVE-2026-109618 and CVE-2026-109619, two critical flaws allowing unauthenticated remote code execution: attackers can run commands on servers without logging in. Agencies in Europe, Australia, Japan, Britain and the U.S. NSA urged immediate updates or taking sites offline. Government websites went offline after AI found the flaws. Aikido Security says exploitation has begun.