DigitalOcean reports two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP affecting all versions from 5 onward. These vulnerabilities allow attackers to execute arbitrary code. Users are urged to patch their PHP installations immediately, as no mitigations other than patching are available. Affected users include those running WordPress, Laravel, and other PHP-based applications. Upgrading to a supported PHP version (8.2 or later) is essential, with detailed steps on how to secure systems provided.