Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619

Unit 42 has flagged two critical remote-code-execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619, both scored 9.2 under CVSS 4.0. The first stems from improper handling of out-of-memory conditions via longjmp(), which leaves request memory uninitialized and lets attackers trigger OOM conditions to reliably gain code execution. The second occurs when longjmp()-based fatal error handling leaves global pointers referencing freed memory, which can later be read or jumped to in subsequent requests to run arbitrary code. Unit 42 reports that proof-of-concept exploits already exist, at least one European government has taken a site offline as a precaution, and Palo Alto Networks' Cortex Xpanse telemetry shows more than 22.6 million potentially exposed internet-facing instances — making immediate patching per the PHP Group's advisory essential given PHP's widespread use across web servers and CMS platforms.