PHP CVSS 9.2 RCE: Patch Isn’t Enough

Yesterday PHP disclosed two critical remote code execution (RCE) vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.2. According to the official advance notice and