Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming

A reliable source has indicated an announcement is scheduled for 22 October 2026 at 18:00 CEST regarding 2x PHP RCEs with a CVSS score of 10.0.

I have no additional evidence to back this up beyond "source: trust me, bro", but if you're running PHP in production it would be prudent to be ready to update as a matter of priority. These CVEs reportedly relate to remote code execution in all affected PHP versions from PHP 5 onwards.

These are the two reserved CVEs for the reported upcoming announcement:

CVE-2026-109618

CVE-2026-109619

---

Comments URL: https://news.ycombinator.com/item?id=50167754

Points: 1

# Comments: 0