PHP developers released patches for CVE-2026-109618 and CVE-2026-109619, two critical flaws that could let attackers remotely seize websites and servers without account access. Millions of sites may be exposed; the PHP Foundation urged immediate updates. Calif and Wiz found the flaws using AI tools