Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)

A critical PHP core vulnerability with a CVSS 9.4 affects essentially all widely deployed PHP versions, creating immediate exposure for internet-facing applications and a race to patch as PoC exploits and early signs of active abuse are already emerging. For CIOs and technology leaders, this is a high-priority operational risk that can disrupt web services, require rapid coordination with Linux distribution vendors for backported fixes, and force temporary compensating controls such as disabling session upload progress, tightening request-size limits, and using WAF protections while preserving business-critical functionality.