PHP 8.2–8.5 RCE via stale global state (CVE-2026-109619)
PHP rates the core flaw critical at CVSS v4.0 9.2; fixed builds are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Stories per day · 30 days
1 RSS
2 stories, newest first · one card per story
Stories tagged #php-src
PHP 8.2–8.5 RCE via out-of-memory corruption (CVE-2026-109618)
An allocation failure during request setup can leave incomplete state reachable, rated CVSS v4.0 9.2.