Security1 hOctober 23, 2026, 19:03

CVE-2026-109619: second critical PHP core RCE rated 9.2

A second PHP core flaw fixed on 21 October 2026 alongside CVE-2026-109618 leaves request state reachable after its memory is freed, enabling remote code execution rated 9.2 under CVSS v4.0. Patches shipped in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 with no authentication required; PHP 8.1 and older remain unpatched.

DEV Community

Open source

CVE-2026-109619: second critical PHP core RCE rated 9.2

CVSS v4.0 score of 9.2, unauthenticated remote code execution
Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Trigger is a fatal error leaving a pointer to freed memory
PHP 8.1 and older branches get no update

#PHP

Nginx UI RCE flaw CVE-2026-107806 rated 9.4 Critical

Security

Drupal warns of fast exploitation risk for critical core RCE flaws

Security

Cisco patches critical NX-API flaw CVE-2026-76471 rated 9.8

Security

CVE-2026-109619: second critical PHP core RCE rated 9.2

Nginx UI RCE flaw CVE-2026-107806 rated 9.4 Critical

Drupal warns of fast exploitation risk for critical core RCE flaws

Cisco patches critical NX-API flaw CVE-2026-76471 rated 9.8

CVE-2026-70024 analysis: critical IIS RCE with no known exploits