The PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both allowing remote code execution. One stems from memory corruption when a request hits memory_limit at the wrong moment; the other from stale global state after a fatal error, enabling use-after-free. The CVSS score is 9.2, not the 10.0 given in leaked details.
On Apache with mod_php, an unauthenticated request can trigger the first flaw before application code runs, and RCE was demonstrated with default settings. It was also confirmed on PHP-FPM via application-level paths. The CVE IDs leaked two days early, prompting a patch release a day ahead of plan. OpenAI said its GPT-5.6 Sol model helped find the flaws; the WSJ says up to 70% of websites could be at risk.
Reuters reports that European government, school and hospital websites were taken offline while organizations patched. Patches cover only PHP 8.2 and newer, leaving legacy deployments dependent on vendors; Cloudflare has deployed WAF mitigations for all customers.