PHP patches two CVSS 9.2 RCEs that fire before application code
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws rated 9.2 on CVSS v4.0. The first corrupts request memory when an out-of-memory condition interrupts a partially initialized request, and the second lets request-owned state survive in a worker after its backing memory is freed. With Apache mod_php the confirmed exploit runs before any application code, which puts framework patches and parameter-level WAF rules downstream of the attack. PHP 8.1 and older receive no project updates, only minimal source backports for 7.4, 8.0 and 8.1, and the advisory states that no configuration mitigation is complete.