PHP patches critical RCE via stale global request state
CVE-2026-109619, rated 9.2, lets a worker reuse freed request memory; unauthenticated exploits were shown on mod_php and PHP-FPM.
By tarpit#php
PHP patches critical unauthenticated RCE in 8.2 through 8.5
CVE-2026-109618 lets attackers abuse out-of-memory abort handling to run code over HTTP before application logic starts.
By tarpitPHP security releases fix SQL injection and out-of-bounds write
Four branches ship fixes for PostgreSQL injection, Phar crashes, libgd, and a BCMath flaw limited to newer lines.
By tarpit