Blog / tag
A critical PHP use-after-free (CVE-2026-109619, CVSS 9.2) lets unauthenticated attackers turn one failed request into code execution on the next. Researchers demonstrated it against default WordPress, Drupal and Joomla installs. Patches are out now.
