There are two CVE’s (CVE-2026-109618, CVE-2026-109619), both with a rating of 9.2 out of 10. They allow unauthenticated code execution.

From the phpfoundation website:

CVE-2026-109618 / GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (out-of-memory): If a request reached PHP’s memory_limit at exactly the wrong moment, PHP could leave partially initialized internal data behind and later treat it as valid, corrupting memory. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.

CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp: RCE via stale global state: A fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request. A later request handled by the same worker could then use that freed memory. A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.

Seems to be working fine for my VPN tunnel I use to get access to my home network, instead of an IP, it has the hostname + port to connect to it and technically I do have a non static IP. The hostname gets resolved via noip.com in this case to an IP address.

You could get a free dynDNS name with noip.com (you’ll need to verify the domain every month by logging in) this way even if you have a dynamic ip, it automatically gets updated via the hostname if you set this in your router (most brands should be able to do this).