New ask Hacker News story: Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming
Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming 196 by petecooper | 30 comments on Hacker News. A reliable source has indicated an announcement is scheduled for 22 October 2026 at 18:00 CEST regarding 2x PHP RCEs with a CVSS score of 10.0. I have no evidence beyond "source: trust me, bro", but if you're running PHP in production, be ready to update as a priority. These CVEs reportedly relate to remote code execution in all affected PHP versions from PHP 5 onwards. These are the two reserved CVEs for the reported upcoming announcement: CVE-2026-109618 CVE-2026-109619