The PHP security team released a patch on October 21 at 2:00 PM UTC to address two critical vulnerabilities rated 9.2 out of 10 on the CVSS v4.0 severity scale. These flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution vulnerabilities affecting all PHP versions since 5.4. Only PHP 8.2 and newer branches will receive official patches, leaving servers running 7.4 or 8.1 without native fixes. Cybersecurity firm Sansec warned that mass attacks could begin within fifteen minutes of the patch release, as threat actors could reverse-engineer the fix to develop exploits. These vulnerabilities directly threaten e-commerce platforms such as WooCommerce, Magento, and Shopware, potentially allowing attackers to redirect crypto deposit addresses.
Source: Read the original article
