Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised.
On October 21, 2026, PHP released the patch fixing multiple memory-safety vulnerabilities in the core engine.
These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.