Kwetsbaarheden verholpen in PHP

PHP has patched two critical vulnerabilities that allow unauthenticated remote code execution on all PHP installations that process web requests. CVE-2026-109618 involves memory corruption during Out-of-Memory handling, causing internal request data to be only partially initialized and treated as valid, enabling RCE. CVE-2026-109619 involves stale internal global state persisting after memory is freed, allowing subsequent requests processed by the same worker to use outdated state before reinitialization, also leading to RCE. Both vulnerabilities are exploitable without authentication via standard web requests. All PHP installations handling web traffic are affected. The PHP team and NCSC urgently advise applying the security updates immediately.