Critical PHP RCE Flaws Leaked, Mass Exploitation Expected

Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) enabling unauthenticated remote code execution have been disclosed, with exploit details leaked. Mass exploitation is anticipated as attackers move quickly, posing significant risk to the large PHP web application ecosystem. The severity and public availability of exploit code elevate the threat level.

AI disclosure: Model-written summary of the source, not a verified fact. Check the sources. How Mosaic works