On 21 October, PHP and Node.js published security advisories on the same day. Two unrelated bugs in two runtimes that run a large part of the web. Read side by side, they are the same bug turned inside out: one runtime kept something it had promised to throw away, the other froze something it had promised would never repeat.

PHP forgot to forget

PHP's oldest promise is that every request starts clean. Nothing survives from one request to the next. It is why most of us stopped thinking about memory the day we wrote our first <?php .

CVE-2026-109619, "RCE via stale global state" (CVSS 9.2), breaks that promise. PHP keeps global state for errors, sessions, objects and extensions, and some of it can point into memory owned by the current request. That state has to be reset before the request memory is released.

A fatal error can skip the reset. So can running out of memory, which ends the request the same way.…