The official advisory describes both flaws as unauthenticated remote code execution, often shortened to RCE. It sounds like jargon, but each part of the phrase tells you something important.
- Remote means the attacker doesn't need to be in your building or on your network. They can be anywhere in the world, sending requests over the internet like any other visitor.
- Code execution means they can make your server run instructions of their choosing. In practice, that is close to handing them the keys.
- Unauthenticated means they don't need a username, password or account first. Your login page is not a barrier.
Put together, this is about the most serious type of flaw a piece of web software can have. Once someone can run their own instructions on your server, they could:
- Steal customer data, including names, addresses, emails and order history
- Plant malware that infects your visitors or skims card details at checkout
- Deface your website or quietly redirect visitors to scam pages
- Use your server to attack other businesses, damaging your reputation
- Get a foothold to move deeper into your wider IT systems
- Encrypt files and demand a ransom
For a UK business, a breach involving personal data can also mean reporting duties to the Information Commissioner's Office, awkward conversations with customers, and real costs in downtime and recovery. Prevention is far cheaper than clean-up.
The Two Flaws, Explained Without the Jargon
Both problems live deep inside PHP itself, not in your website's own code. That is why so many sites are affected at once, and why your developer can't simply fix it in your theme or plugin.
Flaw One: Running Out of Memory at the Wrong Moment
Officially tracked as CVE-2026-109618, this flaw involves what happens when PHP runs out of memory while it is still setting up a request.
Imagine a waiter taking a customer's order. Halfway through writing it down, the kitchen alarm goes off and they rush away, leaving a half-written order on the pad. Later, someone clearing up assumes the order slip is complete and acts on it. The result is chaos, and a clever customer could have deliberately written something nasty in the blank half.
That is roughly what happens here. PHP can be interrupted while its internal paperwork for a visitor's request is only partly filled in. The tidy-up routine then treats that incomplete paperwork as if it were valid. An attacker who can trigger the memory problem on purpose can exploit that confusion.
Flaw Two: Leftovers From a Previous Visitor
Tracked as CVE-2026-109619, the second flaw is about things not being cleared away properly between visitors.
Web servers handle visitors in turn, often using the same worker process again and again. Think of a hotel room. After each guest leaves, housekeeping should reset everything before the next arrival. With this flaw, some notes from a previous guest can survive after the room has officially been emptied. If the next guest gets in before housekeeping finishes, they can use those leftover notes in ways nobody intended.
In technical terms, data belonging to one request can outlive the memory behind it, and a later request on the same worker may use it before normal setup wipes it. An attacker can set this up deliberately across a sequence of requests.
