A pair of vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution. It was rated 9.2 out of 10 under CVSS v4.0 and caused the significant part of the internet (including but not limited to: Pixiv, Umamusume, Gelbooru, rule34.xxx) to go offline on 21 October 2026 in anticipation for the patch.
