PHP Memory Corruption Vulnerability

Mon, 26 Oct 2026 00:00:00 +0000

🚨SEVERITY: UNKNOWNSecurity Advisory

TL;DR 📌

PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
Listed in CISA KEV (2026-10-26) — this is being exploited in the wild.
Check the advisory for fixed releases — remediation detail is in the vendor link below.
CVEs: CVE-2026-109618.

What it is

CVE-2026-109618 is a memory corruption flaw in PHP that allows unauthenticated remote code execution. The PHP Group has not published detail beyond this summary, so the specific component, module, or code path involved is not yet clear.

PHP Stale Internal Request-State Vulnerability

Mon, 26 Oct 2026 00:00:00 +0000

🚨SEVERITY: HIGH — CVSS 8.1Security Advisory

TL;DR 📌

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
Highest CVSS: 8.1 (High).
Listed in CISA KEV (2026-10-26) — this is being exploited in the wild.
Fixed in 10.2.7, 11.1.4, 11.2.4, 12.1.4 — upgrade to this release or later.
CVEs: CVE-2026-109619.

What it is

This is a memory-safety flaw in PHP’s internal request handling. PHP maintains global state that temporarily points into memory allocated for the current request. In certain scenarios that state is not correctly reset between requests, or gets repopulated after a reset, so it ends up referencing request memory that has already been freed.

PHP Group on PhllapsNET

PHP Memory Corruption Vulnerability

TL;DR 📌

What it is

PHP Stale Internal Request-State Vulnerability

TL;DR 📌

What it is