Critical PHP RCE Vulnerability: CVE-2026-109618
On 21 October 2026 the UK National Cyber Security Centre (NCSC) published an alert titled “Critical security issue affecting PHP”. Two vulnerabilities in PHP itself may let an unauthenticated attacker achieve remote code execution (RCE) on a web server running PHP. Both are fixed in new releases. If you run PHP, update first and read the rest later. Summary CVE-2026-109618 CVE-2026-109619 Title RCE via OOM corruption RCE via stale global state CVSS v4.0 9.2 (Critical) 9.2 (Critical) Vector AV:N/AC:H/AT:P/PR:N/UI:N AV:N/AC:H/AT:P/PR:N/UI:N Weakness use-after-free, improper error handling use-after-free, stale global state Both are reachable over the network with no login and no user interaction. ...