19 – 24 Oct 2026 Two recently disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have received critical CVSS scores of 9.2. These flaws in PHP’s memory management and error handling can allow unauthenticated remote code execution (RCE), potentially affecting websites running popular platforms such as WordPress, …