(CVE-2026-109618, CVE-2026-109619): critical unauthenticated RCE in PHP core. Patch out Oct 21. WordPress, Magento, Drupal ...