On 21 October 2026, the PHP project released fixes for two critical vulnerabilities. Both are rated 9.2 on the CVSS v4.0 scale, and both can allow unauthenticated remote code execution. Hosting providers have warned that exploitation is already happening. Here is what the bugs are, how to fix them, and why running PHP in containers made our response much simpler.

What was disclosed

CVE-2026-109618 is remote code execution through out-of-memory corruption. If PHP runs out of memory while it is building internal request data, it can be interrupted with that data only partly initialised. Request cleanup may then treat the invalid data as valid.

CVE-2026-109619 is remote code execution through stale global state. Request-owned internal state can outlive the memory behind it. A later request on the same worker may use that stale state before it is reset.

An attacker needs no login, because the problem sits in how PHP handles the request itself.…