Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Fact · technical · confirmed

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35

Who says it: PHP Group (CNA), GitHub advisories, php.net · Sources: CVE record CVE record PHP PHP php.net

Fact-check

A6 Established · Record · verdict: holds

Both CVE records (CNA PHP Group) carry CVSS 4.0 9.2 CRITICAL and the four fixed-in versions; the two GHSAs, both oss-security announcements and php.net agree. The authoritative record carries every number, so A6.

Capture checkedResultWhat it sayssha256 of the text read
cve-cve-2026-109618carries9.2 CRITICAL 4.0 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nf8705d8e0aa2a248
cve-cve-2026-109619carriesaffectedfrom 8.5.*before 8.5.123162135e82a9edd4
github-ghsa-w8hw-w9fx-j79wcarriesPatched versions 8.2.35 8.3.36 8.4.27 8.5.1284ab95d3b1d538ba
github-ghsa-6wmf-4rv5-p3rpcarriesCritical 9.2 / 10 CVSS v4 base metrics99d85c973c41c024
php-net-advisorycarriesPHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.df0b1bba3deae282
openwall-oss-security-2026-10-21-6carriesSeverity: Critical (CVSS v4.0: 9.2)2f2d3ff13f3a32b7

Open tickets: Contradiction-3, Contradiction-7, Evidence-10, Evidence-6.

Graded in Run-1, resting on captures up to 2026-10-22 08:14 UTC. The scale is on the fact-check page.

This fact over time

  1. 2026-10-21php.net publishes Security advisory: Critical remote code execution vulnerabilities, update now
  2. 2026-10-21 13:34 UTCPHP publishes RCE via OOM corruption (CVE-2026-109618)
  3. 2026-10-21 13:34 UTCPHP publishes RCE via stale global state (CVE-2026-109619)
  4. 2026-10-21 13:48 UTCCVE record publishes CVE-2026-109618: RCE via OOM corruption
  5. 2026-10-21 13:54 UTCCVE record publishes CVE-2026-109619: RCE via stale global state
  6. 2026-10-22 08:09 UTCSaved into the evidence vault: PHP
  7. 2026-10-22 08:09 UTCSaved into the evidence vault: PHP
  8. 2026-10-22 08:09 UTCSaved into the evidence vault: php.net
  9. 2026-10-22 08:12 UTCSaved into the evidence vault: CVE record
  10. 2026-10-22 08:12 UTCSaved into the evidence vault: CVE record
  11. 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

CVE-2026-109618: RCE via OOM corruptionCVE-2026-109619: RCE via stale global stateRCE via OOM corruption (CVE-2026-109618)RCE via stale global state (CVE-2026-109619)Security advisory: Critical remote code execution vulnerab…fact two-cves-9.2

Where this fact appears

In the briefings for:

CaseyWebsite ownerSamSecurity leadDrewPHP or platform engineerAshSecurity researcherRobinCISOAveryCTOMorganData protection officerJamieHead of AppSecLeeDeveloper

And on every claim.

Every version of this fact

v1 · site v0.1.0 · 22 October 2026 · confirmed
Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Who says it: PHP Group (CNA), GitHub advisories, php.net
Status: confirmed
Topic: technical
Sources: cve-cve-2026-109618, cve-cve-2026-109619, github-ghsa-w8hw-w9fx-j79w, github-ghsa-6wmf-4rv5-p3rp, php-net-advisory