Critical PHP Vulnerabilities: Frontier Virtual Patching Customers Were Protected Before Day One
Today, the PHP project disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in the scripting language behind a large share of the world's web servers and content management systems. Both are rated 9.2 under Common Vulnerability Scoring System (CVSS 4.0). Both can be exploited by an unauthenticated attacker.