Originally published -> You can read the full article here
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed in October 2026, both carrying a CVSS score of 9.2.
What makes them interesting?
They aren't caused by poorly written application code. They originate in PHP's core runtime and can potentially lead to Remote Code Execution (RCE).
One involves Out-of-Memory corruption, while the other involves stale global state.
For me, this is another reminder that application security goes beyond writing secure code.
We need to keep an eye on our dependencies, frameworks, runtimes, and infrastructure,not just our own code.
