CVE-2026-109619: PHP Vulnerability, What to Do Now

CVE-2026-109619 is a PHP stale internal request-state flaw allowing unauthenticated RCE. It is in CISA KEV with a 2026-10-29 federal due date.