Interestingly, PHP lists it as a 9.2 but RHEL lists it as an 8.1.

https://access.redhat.com/security/cve/cve-2026-109618 https://access.redhat.com/security/cve/cve-2026-109619

Is this because RedHat's default configuration isn't as vulnerable?

I'm ignorant of how these numbers are calculated. Could PHP on Debian, Ubuntu, etc. be a 9.2 but on RedHat it's only an 8.1 because RedHat has various mitigations?

For 109619, "Exploitation requires hitting a precise out-of-memory condition during request processing, which keeps this below Critical."

The lower criticality may be wishful thinking.