Global – October 27, 2026 -- Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS score of 9.2 and let unauthenticated attackers run code on web servers. Cyber insurer Coalition says its honeypots recorded exploit-related requests more than five hours before PHP released its fix, and it expects exploitation at scale.