Critical security flaws in PHP put server security under scrutiny

The PHP team announced two critical memory-related security vulnerabilities on October 21, 2026, which could allow remote attackers to execute code on servers without passwords or physical access.

The flaws stem from memory corruption errors during cleaning tasks when memory runs low, and stale pointer references in error situations that could allow malicious instructions to run.

While the first vulnerability was identified during a 2024 security review, both flaws were publicly disclosed alongside fixes this month, prompting website owners to install urgent updates.