The PHP development team has issued urgent security patches addressing two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, which posed significant risks to web servers. These flaws, rated 9.2 out of 10 on the CVSS v4.0 severity scale, could potentially allow attackers to execute arbitrary code remotely without requiring any authentication. The PHP development team has issued urgent security patches addressing two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, which posed significant risks to web servers. These flaws, rated 9.2 out of 10 on the CVSS v4.0 severity scale, could potentially allow attackers to execute arbitrary code remotely without requiring any authentication. The PHP development team has issued urgent security patches addressing two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, which posed significant risks to web servers. These flaws, rated 9.2 out of 10 on the CVSS v4.0 severity scale, could potentially allow attackers to execute arbitrary code remotely without requiring any authentication. The PHP development team has issued urgent security patches addressing two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, which posed significant risks to web servers. These flaws, rated 9.2 out of 10 on the CVSS v4.0 severity scale, could potentially allow attackers to execute arbitrary code remotely without requiring any authentication.