{"by":"petecooper","descendants":62,"id":50167754,"kids":[50175009,50174857,50172076,50174624,50175475,50174955,50173697,50176717,50173207,50175031,50171097,50173117,50173055,50178762,50180833,50174294,50174964,50191173,50180220,50183801,50174354,50174623,50175265,50176165,50180030,50175615,50207680,50207678,50168677,50177647,50177907,50177901,50171748,50188521,50175784],"score":298,"text":"A reliable source has indicated an announcement is scheduled for 22 October 2026 at 18:00 CEST regarding 2x PHP RCEs with a CVSS score of 10.0.<p>I have no evidence beyond &quot;source: trust me, bro&quot;, but if you&#x27;re running PHP in production, be ready to update as a priority.<p>These CVEs reportedly relate to remote code execution in all affected PHP versions from PHP 5 onwards.<p>These are the two reserved CVEs for the reported upcoming announcement:<p>CVE-2026-109618<p>CVE-2026-109619","time":1792509635,"title":"Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming","type":"story"}