Tracked as CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state across requests), both rated CVSS v4.0 9.2. Researchers at Calif, Wiz and OpenAI found and exploited them with frontier AI models; details leaked a day early and PHP fixed them on October 21, 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Apache mod_php is the highest-risk setup, and PHP 8.1 and older get no official fix.