October 22, 2026
A Single OOM Request Unlocks Unauthenticated RCE in PHP: Two CVEs Traced Back to 5.4.0 Leave Default WordPress, Drupal, and MediaWiki Vulnerable as Chainguard Breaches Embargo Six Hours Early; Railway Env Vars Exfiltrated and LiteLLM Backdoored
php2shellCVE-2026-109618CVE-2026-109619PHP 8.2.35