Published on October 29, 2026 at 10:57 AM

CVE-2026-109618 is a critical vulnerability affecting PHP’s handling of out-of-memory (OOM) errors. This vulnerability is significant due to its potential to lead to remote code execution (RCE), posing a serious risk to systems running affected versions of PHP.

What the vulnerability is

The vulnerability arises from PHP’s use of the longjmp() function to manage OOM errors. When an OOM error occurs, longjmp() exits the current context and aborts the request handling. However, in some contexts, this process may not properly account for the scenario, leaving request memory in an uninitialized state before performing an allocation. This can result in the subsequent request cleanup procedure reading or branching on this uninitialized memory.

Impact

The improper handling of OOM errors can be exploited by attackers to consistently trigger conditions that lead to remote code execution. This makes the vulnerability particularly dangerous, as it allows attackers to execute arbitrary code on the affected systems, potentially compromising the entire server environment.

Affected systems

Affected systems have not been publicly disclosed at the time of writing.

Mitigation

To mitigate the risks associated with CVE-2026-109618, it is recommended to upgrade to PHP versions 8.2.35, 8.3.36, 8.4.27, 8.5.12, or later. PHP 8.1 and older versions are end-of-life upstream, so upgrading to a supported branch or applying vendor backports is crucial for maintaining security.

Continuous scanning and timely updates are essential strategies to protect systems from vulnerabilities like CVE-2026-109618. By ensuring that PHP installations are up-to-date, organisations can significantly reduce the risk of exploitation.