Bug 2556842 - CVE-2026-109618 & CVE-2026-109619: Undisclosed unauthenticated RCE exploit in PHP
Summary: CVE-2026-109618 & CVE-2026-109619: Undisclosed unauthenticated RCE exploit in...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: php
Version: rawhide
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Remi Collet
QA Contact: Fedora Extras Quality Assurance
URL: https://cert.europa.eu/publications/s...
Whiteboard:
Depends On:
Blocks: F45FinalBlocker, FinalBlocker
TreeView+ depends on / blocked
 
Reported: 2026-10-20 22:47 UTC by Daniel Milnes
Modified: 2026-10-21 08:59 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Daniel Milnes 2026-10-20 22:47:39 UTC 
We don’t have many details yet, but the PHP team have warned they will be disclosing an unauthenticated RCE in PHP Core.

The vulnerability will be disclosed officially at Wednesday, 21 October 2026 at 14:00 UTC, however there is anecdotal evidence on social media of exploits already existing.

Raising this ticket to track our response and consider as a release blocker.

https://cert.europa.eu/publications/security-advisories/2026-018/
https://www.php.net/archive/2026.php#2026-10-20-1

Reproducible: Always
Comment 1 Fedora Blocker Bugs Application 2026-10-20 22:49:56 UTC 
Proposed as a Blocker for 45-final by Fedora user thebeanogamer using the blocker tracking app because:

 Critical security vulnerabilities should be fixed.

PHP is not a critical path package, but it is a very common package to install on servers.
Note You need to log in before you can comment on or make changes to this bug.