CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption
CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption
Posted by Jakub Zelenka on Oct 21 Hello, The PHP security team announces a critical vulnerability in PHP core (php-src). CVE: CVE-2026-109618 Severity: Critical (CVSS v4.0: 9.2) Affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27, and PHP 8.5 before 8.5.12. PHP uses longjmp() to abort request handling on out-of-memory (OOM) errors. An allocation failure can…
Vulnerabilities mentionedAll →
- CVE-2026-1096189.2—PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the requestpublished · php php PoC ×25
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-109618 | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). |
Posted by Jakub Zelenka on Oct 21 Hello, The PHP security team announces a critical vulnerability in PHP core (php-src). CVE: CVE-2026-109618 Severity: Critical (CVSS v4.0: 9.2) Affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27, and PHP 8.5 before 8.5.12. PHP uses longjmp() to abort request handling on out-of-memory (OOM) errors. An allocation failure can interrupt initialization while incomplete request state is already reachable....
This source does not provide full text. Read it at seclists.org.
Akamai Blog