Two serious security flaws in PHP, a language used by around 70% of websites with a known server-side language, have put web servers at risk of remote code execution without authentication. These vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. PHP released emergency security fixes on 21 October 2026. Attackers reportedly started trying to exploit these flaws even before and shortly after their public disclosure. The main issue is related to memory management. When PHP faces a critical error, such as running out of memory, it may leave behind request data that can be trusted by later processes. This shows how even a small memory-handling issue can turn into a major security risk.