#php-fpm

PHP patches critical RCE via stale global request state

CVE-2026-109619, rated 9.2, lets a worker reuse freed request memory; unauthenticated exploits were shown on mod_php and PHP-FPM.