Same week, same interpreter: CVE-2026-109618 and the two-defect PHP release

Two critical PHP core vulnerabilities were fixed in the same patch set on 21 October 2026, and the national CERT advisories treat them as a pair. They share a severity rating and a fixed-version list, but the underlying defects are different, which matters when deciding how to respond.

The pair

CVE-2026-109618 is memory corruption during out-of-memory handling. CVE-2026-109619 is stale internal state that survives after the memory behind it has been released. Both permit unauthenticated remote code execution and both are rated 9.2 under CVSS v4.0.

Affected releases are PHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.35. The fixes arrived on 21 October, one day after the project's pre-announcement.

Two different failure modes

For CVE-2026-109618, the engine's memory_limit enforcement path is the problem.…