The warning names CVE-2026-109618 and CVE-2026-109619 as the reserved identifiers for two PHP vulnerabilities. An announcement is reportedly scheduled for 22 October 2026 at 18:00 CEST. Both flaws are described as remote-code-execution issues with a CVSS score of 10.0.

The original poster says the information comes from a reliable source but offers no supporting evidence beyond that claim. The post says the affected version range could extend back to PHP 5. A later comment places the vulnerabilities in PHP core and says only PHP 8 will receive patches. Those technical details come from the discussion rather than the original warning.

Another commenter initially confused these identifiers with CVE-2026-9618 and CVE-2026-9619. Those entries concern WordPress plugins and are not RCE vulnerabilities. A separate comment links to a PHP archive statement dated 20 October 2026 and to a CERT-EU advisory. It says organisations unable to patch immediately should consider isolating internet-facing applications from public networks until a fix is available. Further details were reportedly due at 14:00 UTC the following day, although the timing could change.