PHP RCEs, CA compromise, and library patches

Two critical remote code execution flaws in PHP 8.2 through 8.5 led the day's security disclosures, alongside a compromised certificate authority intermediate and fixes across Pulsar, musl, HTTP/3 stacks, Pillow, and BIND. Operators of affected software should prioritize available upgrades.

PHP RCE via stale global state

The PHP security team disclosed CVE-2026-109619, a critical use-after-free remote code execution vulnerability in PHP 8.2 through 8.5. Demonstrated exploits target mod_php and FPM setups. Anyone running these versions has reason to apply patches without delay.

PHP RCE via OOM corruption

The PHP security team disclosed CVE-2026-109618, a critical unauthenticated remote code execution flaw rated CVSS 9.2 in PHP 8.2 through 8.5, arising from OOM longjmp handling. Upgrades are required to close the issue.

eMudhra intermediate CA keys compromised

Private keys for eMudhra intermediate certificate authorities were compromised and described as trivially recoverable, leading to browser root removals and trust store updates across major platforms. Services depending on those intermediates face disrupted certificate validation.

Apache Pulsar fixes 14 CVEs

Apache Pulsar announced fixes for 14 CVEs, including one critical, in releases 4.0.14, 4.2.5, and 5.0.0. Users are advised to upgrade to the patched versions.

musl libc regcomp integer overflows

The musl maintainer disclosed multiple integer overflows in regcomp that affect all versions through 1.2.6. The bugs can produce incorrect allocation sizes and out-of-bounds heap writes.

QPACK amplification against HTTP/3

A report details QPACK amplification vulnerabilities in multiple HTTP/3 implementations that permit remote out-of-memory attacks. Operators of HTTP/3 servers should assess their exposure to the issue.

Pillow 13.0.0 vulnerability fixes

Pillow 13.0.0 addresses a long list of vulnerabilities, among them multiple critical and high severity CVEs in image decoding and parsing. Python applications that depend on the library should move to the new release.

ISC discloses four BIND 9 flaws

ISC disclosed four vulnerabilities in BIND 9 (CVE-2026-19630, CVE-2026-94300, CVE-2026-96888, CVE-2026-97313) involving memory corruption, denial of service via RPZ, redirects or QNAME, and resource exhaustion. Patches have been released.