cve-2026-109619

Two Pre-Auth PHP Flaws Put 70% of the Web on the Clock

Working exploit attempts are already circulating for two pre-auth RCE flaws in PHP's runtime. We price out patching, WAF rules and pulling the plug.