grep -rl "CVE-2026-109619" ./articles
The technical reason is memory management and error handling. The organisational reason is in the post-mortem, which calls the delay a structural failure. And the emergency release carried a second heap corruption nobody was looking for.
Root Notes reports on this identifier; it does not maintain it. For the vendor advisory, the affected versions and the scoring, NVD and MITRE hold the primary records.
Not listed in CISA's Known Exploited Vulnerabilities catalog as of catalog 2026.10.21. That is not evidence it is not being exploited — the catalog records what CISA has confirmed, and identifiers have been attacked for days before appearing in it.
The technical reason is memory management and error handling. The organisational reason is in the post-mortem, which calls the delay a structural failure. And the emergency release carried a second heap corruption nobody was looking for.
We wrote on Wednesday that the CVE identifiers leaked. The post-mortem published the same day is more specific, and worse: a proof-of-concept video from Calif, mitigation advice to critical infrastructure, and a vendor shipping the fix six hours early.
Two unauthenticated remote code execution flaws in PHP itself. OpenAI says one was found by Calif using GPT-5.6 Sol and both by Wiz independently, with a coordinated response behind it. Then the identifiers leaked.
../cve — every identifier we have covered