Originally published -> You can read the full article here
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed in October 2026, both carrying a CVSS score of 9.2.
What makes them interesting?
They aren't caused by poorly written application code. They originate in PHP's core runtime and can potentially lead to Remote Code Execution (RCE).
One involves Out-of-Memory corruption, while the other involves stale global state.
For me, this is another reminder that application security goes beyond writing secure code.
We need to keep an eye on our dependencies, frameworks, runtimes, and infrastructure,not just our own code.
Top comments (2)
Great write-up, Gulnur! 👏
One thing I’ve learned from managing production infrastructure is that secure application code doesn’t necessarily mean a secure system.
Runtime vulnerabilities are particularly dangerous because they can bypass assumptions developers make about their own code.
I’d also emphasize the importance of verifying patches in production. Updating PHP packages is one thing; confirming that PHP-FPM workers are actually running the patched version is another.
Security isn’t just about applying fixes. It’s about verifying that those fixes are actually effective. 🔐
Absolutely,verifying that the patched version is actually running is just as important as applying the update. Great point about production environments. Thanks for the comment ☺️