Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming

A reliable source has indicated an announcement is scheduled for 22 October 2026 at 18:00 CEST regarding 2x PHP RCEs with a CVSS score of 10.0.

I have no evidence beyond "source: trust me, bro", but if you're running PHP in production, be ready to update as a priority.

These CVEs reportedly relate to remote code execution in all affected PHP versions from PHP 5 onwards.

These are the two reserved CVEs for the reported upcoming announcement:

CVE-2026-109618

CVE-2026-109619