CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
// summary
The PHP project released security updates for two critical unauthenticated remote code execution flaws affecting memory handling and request state.
// from the source
Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges. CVE CVSSv4 Description CVE-2026-109618 9.2 (Critical) RCE via OOM corruption CVE-2026-1096