On October 21, PHP released a security update addressing two vulnerabilities and strongly recommended that users update their installations immediately. Both vulnerabilities involve PHP’s handling of memory and request data. Under certain conditions, they can lead to memory corruption, potentially allowing attackers to execute code remotely without authentication.
As web technologies are an integral part of many IT infrastructures, security vulnerabilities can have implications beyond traditional websites, potentially affecting applications and services used in professional media environments.
The good news is that ELEMENTS environments are not affected. PHP is not used in any of our products or internal tooling, so these vulnerabilities pose no risk to ELEMENTS systems. ELEMENTS environments are also not affected by the latest Node2Shell (CVE-2026-111497) vulnerability in Node.js.
The security update addresses the following vulnerabilities:
-
RCE via OOM corruption CVE-2026-109618 : An out-of-memory condition can interrupt the initialization of request data, causing PHP to mishandle incomplete data during cleanup and potentially resulting in memory corruption.
RCE via stale global state CVE-2026-109619: PHP may retain internal request state after the associated memory has been freed. A subsequent request handled by the same worker may access this stale state before it is reset.
For further technical details, including affected versions and available fixes, consult the official PHP security advisory.
