Two CVSS 9.2 RCE Vulnerabilities in PHP Push a European Government Site Offline
HankYeomans · x · 2026-10-22
Palo Alto Networks Unit 42 details two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (CVSS 4.0). Both involve improper longjmp() fatal/OOM error handling leaving uninitialized or freed memory exploitable for arbitrary code execution. PoCs exist and at least one European government took its website offline as a precaution; admins are urged to patch immediately.
More from Infra
- 8x NVIDIA DGX Spark cluster with 200GB switch becomes SF's new flex — beffjezos · 2026-10-22
- NVIDIA Cosmos-3-Nano world models go live on Reactor's robot inference cloud — chris_j_paxton · 2026-10-22
- Abacus.AI CEO beta-tests GPU-hosted apps on SuperComputer, runs 3D flying-car game — bindureddy · 2026-10-22
- 2-bit draft in VRAM + exact residual in RAM: speculative decoding for models that don't fit your GPU — Happy_Guitar3521 · 2026-10-22
- Seroter's daily list: OpenAI models land on Google Cloud, PHP CVEs, Genkit Go 1.14 — rseroter · 2026-10-22
- inference.net tops OpenRouter third-party hosts at 14% share, serving ~10% of daily volume — Ronangmi · 2026-10-22