Critical Remote Code Execution Vulnerabilities Discovered in PHP, Patches Released

Two critical security flaws, tracked as CVE-2026-109618 and CVE-2026-109619, have been identified in PHP, potentially allowing unauthenticated remote code execution. The PHP project released fixes for these vulnerabilities on October 21, 2026. The flaws, rated 9.2 on the CVSS v4.0 scale, stem from out-of-memory errors and stale global state, which can be exploited to run arbitrary code. Users are urged to update their PHP installations to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart all PHP processes.