VaultLayer

Platform

Security Alerts

Advisories relevant to common website stacks. This list is informational — always verify impact against your own inventory before changing production.

AllWordPressJoomlaPHPGeneral

PHP critical RCE via OOM corruption (CVE-2026-109618)

Wed Oct 21 2026 14:00:00 GMT+0000 (Coordinated Universal Time)
criticalPHPphp

Unauthenticated remote code execution risk in PHP request handling when out-of-memory interrupts partial internal initialization. Highest risk for mod_php; also affects PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12. Update is the only complete fix. See php.net security advisory (21 Oct 2026).

What to do: Upgrade PHP to the fixed release for your branch (8.2.35, 8.3.36, 8.4.27 or 8.5.12+). Updating is the only complete fix — see php.net for temporary mitigations.

PHP critical RCE via stale global state (CVE-2026-109619)

Wed Oct 21 2026 14:00:00 GMT+0000 (Coordinated Universal Time)
criticalPHPphp

Unauthenticated remote code execution risk when request-owned internal state survives after memory is freed across worker requests. Partial mitigation: session.upload_progress.enabled=0 (and fatal_error_backtraces=0 on PHP 8.5) — not a complete fix. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12. Update is the only complete fix. See php.net security advisory (21 Oct 2026).

What to do: Upgrade PHP to the fixed release for your branch (8.2.35, 8.3.36, 8.4.27 or 8.5.12+). Updating is the only complete fix — see php.net for temporary mitigations.