CVE-2026-109618

PHP Ships Fixes for Two Critical Unauthenticated-RCE Flaws

PHP fixed two critical unauthenticated remote-code-execution flaws after AI-assisted discovery, as operators took public websites offline and raced to patch.