PHP RCE CVEs Incoming

Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming A reliable source has indicated an announcement is scheduled for 22 October 2026 at 18:00 CEST regarding 2x PHP RCEs with a CVSS score of 10.0. I have no evidence beyond "source: trust me, bro", but if you're running PHP in production, be ready to update as a priority. These CVEs reportedly relate to remote code execution in all affected PHP versions from PHP 5 onwards. These are the two reserved CVEs for the reported upcoming announcement: CVE-2026-109618 CVE-2026-109619

A Hacker News screenshot announces two supposedly critical PHP remote-code-execution vulnerabilities with a perfect CVSS score, citing only “source: trust me, bro.” The absurdly specific future CVE numbers and unsupported claim parody sensational security rumors, making it useful as a reaction to exaggerated tech panic or dubious breaking news. EN: A Hacker News screenshot announces two supposedly critical PHP remote-code-execution vulnerabilities with a perfect CVSS score, citing only “source: trust me, bro.” The absurdly specific future CVE numbers and unsupported claim parody sensational security rumors, making it useful as a reaction to exaggerated tech panic or dubious breaking news.

• @gentoomemes / 22275 2026-10-20