CVE-2026-107823: How a Crafted Username Becomes MariaDB Security Metadata

CVE-2026-107823 is a MariaDB Server privilege escalation flaw with a CVSS v3.1 score of 7.2, allowing authenticated users with specific permissions to create crafted usernames. Simultaneously, critical PHP engine vulnerabilities CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution. These PHP flaws, fixed on 21 October 2026, affect memory management and error handling. The PHP project emphasizes that updating to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 is the only safe mitigation available.