By James Tran, Chief Information Security Officer ServLogi is aware of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, publicly disclosed on October 21, 2026. Either lets an attacker run arbitrary code on a server running PHP. Public proof-of-concept code exists, and patching is the only ...