What PHP's CVSS 9.2 rating means for shared hosting after CVE-2026-109618

On a dedicated server, remote code execution in the web server account is serious. On a shared host running hundreds of tenants from one interpreter build, it changes what one customer can reach. The PHP advisory published on 21 October 2026 is worth reading with that deployment model in mind.

The advisory in one paragraph

CVE-2026-109618 and CVE-2026-109619 are critical PHP core vulnerabilities, both rated 9.2 under CVSS v4.0, both allowing unauthenticated remote code execution. Fixes shipped on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CERT.RS relayed the release with recommendations for Serbian operators, and CSIRT.CY published the technical detail.

The trigger is memory exhaustion, not a payload format

The engine enforces memory_limit with longjmp() . When a request allocates past the ceiling, PHP aborts to a recovery point rather than unwinding normally.…