CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities in the PHP core runtime. Both can allow an unauthenticated attacker to achieve remote code execution (RCE), and both received a CVSS v4.0 severity score of 9.2 / 10 . If you run PHP in production whether with Laravel, Symfony, WordPress, Magento, TYPO3, Drupal, or a custom application, this is not a framework problem you can ignore. It is a runtime problem. TL;DR Two critical PHP vulnerabilities were d...