Critical Vulnerabilities in PHP

Affected Environment
PHP installations serving web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed; mod_php carries the highest risk.

Threat Overview
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution by corrupting or reusing memory belonging to a single request.

Exposure Timeline
Fixes released 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP 8.1 and older receive none.

Attack Surface
Any internet-facing PHP worker handling web requests; end-of-life branches 8.1, 8.0, and 7.4 have no project fix.

Technical Root Cause
Out-of-memory handling via longjmp leaves request memory invalid; stale global state causes use-after-free in later requests.

Exploitation Pathway
Attacker triggers an allocation failure or reuses dangling request state, using a crafted heap layout to achieve code execution.