Crypto security chiefs sound alarm as PHP emergency patch scrambles devs worldwide

On Oct. 21, PHP issued patches for two critical flaws that enable attackers without authentication—people lacking valid login credentials—to execute code on web servers. The PHP team’s security advisory names the two flaws CVE-2026-109618 and CVE-2026-109619 and came after its Oct. 20 advance warning. Both are rated critical under the CVSS v4.0 severity scoring system. Crypto security executives called on web server operators to apply the fixes and inspect overlooked infrastructure.