PHP Core Vulnerabilities Allow Unauthenticated Remote Code Execution

Wiz Research identified multiple memory-safety flaws in the PHP core engine affecting all versions since 5.4. These vulnerabilities allow unauthenticated remote code execution and memory disclosure, independent of the specific application layer. Critical patches were released on October 21, 2026, to address these long-standing issues.