Memory limits and attack windows: a defender's reading of CVE-2026-109618
A configuration value that most teams tune once and forget sits at the centre of the PHP vulnerability published on 21 October 2026. memory_limit is the trigger for CVE-2026-109618, and understanding why changes how a defender should think about tuning it.
Facts from the advisories
CVE-2026-109618 is a critical PHP core flaw rated 9.2 under CVSS v4.0, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. It allows remote code execution without authentication. CVE-2026-109619, fixed in the same release, carries the same rating and the same exploitation outcome.
The mechanism
PHP imposes the per-request memory ceiling through longjmp(). When an allocation request would exceed the limit, the engine jumps out of the current execution to a recovery point. The jump is fast because it does not unwind the stack and does not finish initialising the structures that the request was building.
CSIRT.CY describes the consequence. Cleanup after the abort processes fields that were never populated. It cannot tell invalid data from real data, so it attempts to free memory the request never allocated. At that address the allocator may still hold content from an earlier allocation, and the attacker can influence what was there.
Upload parsing is the example given in the advisory, because a multipart body leaves boundary state, part headers and temporary handles half-constructed while the body streams in.
Why the setting matters
A low memory_limit is normally treated as good hygiene. It protects the host from runaway scripts. In this case, a lower ceiling makes the abort state easier to reach, so a hardened configuration can be more exposed to the specific window the flaw depends on than a generous one.
That does not make raising the limit a fix. It changes the effort required to reach the vulnerable state without altering the defect. The only effective response is the patched interpreter; the configuration discussion belongs to temporary risk reduction.
Exploitation conditions
An attacker needs a reachable PHP execution path that accepts request bodies, and needs enough control over allocation to drive the request past the ceiling at a chosen moment. No credentials are involved. Anything at the edge that caps request body size, rejects unexpected multipart payloads, or terminates requests before they reach the interpreter reduces the reachable surface.
Impact
The outcome described is code execution in the web server's context. From there an attacker reads application configuration and credentials, reaches internal services from the host's network position, and can write files the application is allowed to write. Repeated triggering provides a low-cost denial of service even when code execution is not achieved.
Affected scope
Unpatched PHP 8.5, 8.4, 8.3 and 8.2 builds below the fixed versions are affected. PHP 8.1 and older are end-of-life; the project published minimal retrospective fixes for 7.4, 8.0 and 8.1 for source builders and organisations without LTS coverage.
Exposure context
ZoomEye recorded 94,382,282 matches for app="PHP". As with any fingerprint-based count, it identifies systems where the update matters and says nothing about which of them are exploitable.
Remediation
Upgrade the interpreter to a fixed build and verify the running process reports it. For applications that accept uploads, review what the front-end proxy allows through and cap body size independently of the PHP setting. Isolate internet-facing PHP applications from internal networks until the update is confirmed. Check embedded PHP copies against the NCSC-NL repository named in the advisory, since those do not follow the upstream schedule.
