9 min read
CVE-2026-109618 and CVE-2026-109619 — why the PHP alert caused a global scramble
CVE-2026-109618 and CVE-2026-109619 are the sort of paired flaws that trigger a global incident response: a public web-facing service accepts attacker-controlled input, a weakness in the PHP handling path turns that input into privileged behavior, and the result can be remote code execution or data theft on vulnerable systems.