Blog / tag
A critical PHP flaw (CVE-2026-109618, CVSS 9.2) lets unauthenticated attackers turn out-of-memory errors into remote code execution and heap memory leaks. Apache mod_php and FrankenPHP are most exposed. Patch to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 now.
A critical PHP use-after-free (CVE-2026-109619, CVSS 9.2) lets unauthenticated attackers turn one failed request into code execution on the next. Researchers demonstrated it against default WordPress, Drupal and Joomla installs. Patches are out now.
