Two critical PHP flaws scored 9.2 on CVSS v4.0. CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution on web servers running PHP.