PHP

Two critical RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been identified in the PHP core, allowing unauthenticated attackers to execute code via multipart form manipulation. The flaws are being actively exploited by automated scanning tools following a leak of proof-of-concept material.

A long-standing bug in PHP-FPM's FastCGI client authorization logic allowed a massive range of IPv6 addresses to bypass access controls. The issue stemmed from a hardcoded 12-byte comparison that failed to validate the full 128-bit IPv6 address.

Using an advanced multi-agent LLM approach, a researcher discovered a critical zero-day vulnerability in WordPress that allows for pre-authentication RCE. The exploit chain leverages the WordPress batch API to trigger an SQL injection, which is then escalated to full system control.