3 sources filed · EN 3
2024 audit: 57 days, five auditors, no fuzzing because "setting up the necessary environment proved too complex within the given timeframe".
57 dayslength of the 2024 Quarkslab audit of PHP's core by five auditors
Four exploitable bugs under two CVEs (CVE-2026-109618, CVE-2026-109619): an upload-progress unserializer use-after-free, a process-memory disclosure via the PHPSESSID cookie, a fatal-error backtrace use-after-free and an OPcache type confusion.
5.4oldest PHP version affected by at least one of the bugs
CVE-2026-109618: hitting memorylimit at the wrong moment leaves partly initialised data; on Apache with modphp, an unauthenticated request triggers it before application code runs, with RCE shown on default settings.
15CVEs published by the PHP security team since 1 July 2026