PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.
CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): RCE via OOM corruption—out-of-memory handling can interrupt PHP while internal request data is only partially initialized.
CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): RCE via stale global state—request-owned internal state can survive after backing memory is freed; a later request in the same worker may use stale state.
Affected: PHP 5.4 through 8.5.11 for web-serving deployments (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed). PHP 8.1 and older are EOL; minimal backports exist for 7.4–8.1 for source builds only.