PHP 8.2–8.5 OOM RCE cited again (CVE-2026-109618)
Original title: Re: CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption
Christian Fischer's October 23 reply only links a CrowdStrike blog about PHP RCE zero-days.
An oss-security follow-up on CVE-2026-109618 adds no technical description. Christian Fischer posted it solely to point readers to a CrowdStrike blog about protecting customers from PHP remote-code-execution zero-days. The subject says the issue is remote code execution via out-of-memory corruption in PHP 8.2–8.5.
Unconfirmed: The post does not confirm exploitation or reproduce the CrowdStrike blog's claims.
- The message body contains only a CrowdStrike blog URL.
- No fixed version is given in the post.
- No exploitation status is stated in the post.
Impact: remote code execution, as claimed in the subject
| Product | Affected |
|---|---|
| PHP | 8.2–8.5 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-109618 | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 12% | PoC ×25 |
From the original article
Posted by Christian Fischer on Oct 23 Only for references on this: https://www. crowdstrike. com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/ Regards
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.