On 21 October 2026 the PHP project released emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619. They let an attacker run code on any web server that executes PHP. The websites Webcoda builds, ...
