It was discovered that PHP incorrectly handled out-of-memory conditions
while processing requests. A remote attacker could use this issue to
execute arbitrary code. (CVE-2026-109618)
It was discovered that PHP incorrectly managed internal request state
across worker reuse. A remote attacker could use this issue to execute
arbitrary code. (CVE-2026-109619)