Vulnerabilities CVE-2026-109618 and CVE-2026-109619 have been disclosed in PHP which, under certain conditions, may allow unauthenticated remote code execution.