On 2026-10-21 the PHP project disclosed two unauthenticated remote code execution vulnerabilities ( php.net announcement ):

CVE-2026-109618 ( GHSA-w8hw-w9fx-j79w ): out-of-memory handling can interrupt PHP while internal request data is only partly initialized, and request cleanup may then treat that invalid data as valid.

CVE-2026-109619 ( GHSA-6wmf-4rv5-p3rp ): internal state owned by a request can survive after its memory is freed, and a later request on the same worker may use it.

Every PHP installation that serves web requests is affected: PHP-FPM, Apache mod_php, php-cgi and others. The advisory rates the risk highest for mod_php , where an unauthenticated request can trigger the attack before any application code runs.

Fixed releases exist only for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 . PHP 7.4 is end of life, but because the bugs are so severe, the PHP security team published minimal source backports for 7.4, 8.0 and 8.1.

The official Docker images php:7.4-* will not be rebuilt.…