Two memory-related vulnerabilities have been discovered in PHP versions prior to specific patched releases. An unauthenticated remote attacker can exploit these flaws by sending crafted HTTP requests. The first, CVE-2026-109618, is a memory corruption issue in PHP's out-of-memory handling. This occurs when an out-of-memory condition interrupts request processing with partially initialized data. Subsequent cleanup attempts access invalid memory, leading to corruption and potential code execution. The second, CVE-2026-109619, is a use-after-free vulnerability in global state management. This happens when a worker retains a reference to freed request memory, allowing a subsequent request to access stale state. Both vulnerabilities can result in arbitrary code execution, compromising confidentiality, integrity, and availability. Apache mod_php deployments are particularly at risk, as exploitation can occur before application code runs. The solution is to update PHP to the patched versions immediately. If patching is not possible, temporary mitigations for both CVEs are available. These include adjusting memory limits, disabling session upload progress, and enforcing server-level request limits. Network segmentation and running PHP with minimal privileges can also limit impact.