This was supposed to be embargoed.

So your reliable source can't keep a secret.

Those CVEs refer to vulnerabilities in wordpress plugins (not php) and the vulnerabilities are not RCEs.

Am I missing something?

https://nvd.nist.gov/vuln/detail/cve-2026-9618 https://nvd.nist.gov/vuln/detail/cve-2026-9619

Well great thanks. I need details now. Where, core? Extensions? What config?

My guess is on some request filtering thing

Official statement released by PHP: https://www.php.net/archive/2026.php#2026-10-20-1

Statement by CERT-EU: https://cert.europa.eu/publications/security-advisories/2026... :

>Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available.

It seems serious. Well, good luck isolating all PHP applications from the public internet...

[flagged]