At 14:00 UTC on October 21st, PHP released patches to two critical CVEs, both of which can lead to remote code execution. CVE-2026-109618 addresses an RCE through an out-of-memory error, and CVE-2026-109619 addresses an RCE through a stale global state issue.  The flaws were discovered by researchers at Wiz and at Calif, the latter as […]