Rapid7 says multiple public proof-of-concept exploits for CVE-2026-109618 and CVE-2026-109619 are available and that each "demonstrates RCE only against a specific combination of operating system, PHP version, and web server, and none appears to be broadly reliable".

The exact words it rests on

Multiple public proof-of-concept (PoC) exploits for CVE-2026-109618 and CVE-2026-109619 are now available. Rapid7 researchers have reviewed these and observe that each demonstrates RCE only against a specific combination of operating system, PHP version, and web server, and none appears to be broadly reliable.

What the source said when we opened it, on 23 Oct 2026.

The source

CVE-2026-109618 and CVE-2026-109619: Critical unauthenticated remote code execution in PHP
Rapid7 · 2026-10-21

Open the sourcearchived copy

Checked

Checked by the notis newsroom on 23 Oct 2026, against the source above.

In the story

PHP patches two critical remote code execution flaws 23 Oct 2026