PHP2Shell Patches Drop at 14:00 UTC; Workarounds Proven Inadequate
PHP maintainers are releasing emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, at 14:00 UTC on October 21, 2026. Rated 9.2 out of 10 on the CVSS v4.0 scale, these flaws affect PHP core and were disclosed early after a leak. While no active exploitation has been confirmed, security experts warn that mass attacks could begin immediately after the patch release. Administrators are urged to prepare for immediate updates, as no reliable workaround exists prior to the fix.