CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

T1Covered by 1 source · first reported by Rapid7 at 21 Oct, 15:22 UTC

Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4…