Technical Information

An unauthenticated attacker can exploit a use-after-free vulnerability in PHP by triggering persistent worker state to retain references to memory released after a previous request, causing a subsequent request handled by the same worker to access stale memory and potentially resulting in information disclosure, denial of service, or arbitrary remote code execution.

Patch release date: Oct 21, 2026
Further information on this vulnerability is available at : CVE-2026-109619