PHP Critical Vulnerability October 2026 (CVSS 9.2): How It Was Found, How the Exploit Works and Is There a PoC?
The fix is out. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 patch two critical CVSS 9.2 RCE bugs, CVE-2026-109618 and CVE-2026-109619. Searching for how they work, the exploit or a PoC? Here is what is officially known.

