The issues are CVE-2026-109618 and CVE-2026-109619.
Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP says installations handling web requests are in scope, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. It identifies mod_php as the highest-risk configuration and says it has demonstrated an exploit path that can run before application code executes.
One flaw concerns out-of-memory handling while internal request data is partially initialized; the other concerns request-owned state surviving after its backing memory is freed and being reused by a later worker request. PHP says only updating is a complete solution. It lists configuration measures that may reduce specific attack paths but explicitly says they do not make an installation safe.
PHP 8.1 and older are no longer supported by the project, though some distribution and LTS vendors may provide backports. The source does not provide a CVSS score, affected-installation count, or evidence of exploitation outside the demonstrated mod_php attack path.