Unauthenticated remote code execution: when PHP runs out of memory while request data is only partially initialised, cleanup treats it as valid and attacker-controlled state can be injected. Highest risk under Apache mod_php; every request-serving SAPI is at risk (FPM, CGI, LiteSpeed). Public PoC footage; confirmed in-the-wild; added to CISA KEV 2026-10-26.

Use-after-free: request-owned internal state survives after its backing memory is freed, and a later request on the same worker reuses it — giving unauthenticated RCE plus confirmed memory disclosure. Mitigation without patching: session.upload_progress.enabled=0 (+ fatal_error_backtraces=0 on 8.5), then restart every PHP worker. Exploitation attempts observed pre-disclosure (AWS MadPot, 2026-10-17).

PHP 2026-10-23 informational advisory: an RCE vector in session upload progress under an unusual configuration/application combination. Interim mitigation is the same setting as CVE-2026-109619: session.upload_progress.enabled=0.

Kernel privesc used in an observed 2026-10 campaign where a custom php2shell exploit + Fragnesia chained to root access on internet-facing firewalls. Reinforces PHP2Shell's rule: patch the exposed PHP flaw first, then verify kernel-version exposure on the same host.