Inside CVE-2026-109618: how PHP's out-of-memory path became a remote code execution bug

PHP's memory limit is meant to protect a server from a runaway script. On 21 October 2026 the PHP project shipped fixes for a flaw that turns that safety mechanism into an attack primitive. CVE-2026-109618 is graded 9.2 under CVSS v4.0 by the national CERTs that relayed the advisory, and it allows remote code execution without prior authentication.

The same release also closes CVE-2026-109619, a separate defect in request state handling with the same severity rating. Both are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published on 21 October after a pre-announcement on 20 October.

What the advisory actually says

CERT.RS summarises the pair as two critical PHP core vulnerabilities whose exploitation lets an attacker run arbitrary code remotely, with no login step. The Serbian advisory lists the fixed versions and points readers at the PHP project archive and the UK NCSC notice for detail.

The Cypriot CSIRT advisory carries the technical description. For CVE-2026-109618 it describes memory corruption that occurs while PHP handles out-of-memory conditions. Nothing in either advisory claims that a public exploit exists, and neither names specific vulnerable applications. The rating reflects the potential of the defect class, not a confirmed campaign.

The mechanism: longjmp, partial initialisation and request teardown

PHP enforces the per-request memory_limit through longjmp(). When a script asks for more memory than the limit allows, the engine aborts the current request by jumping back to a known state instead of returning an error through the normal call path.

That abort can land while the engine is only partway through preparing the request's internal structures. The Cypriot advisory gives form upload parsing as the example: the request body and its metadata are being populated at the moment the memory limit trips.

Because the abort is not an orderly unwind, the teardown phase that follows can encounter fields that were never initialised. The advisory describes cleanup code treating that invalid data as valid and attempting to release memory that was never allocated in this request. The allocator may hand back a block that still contains contents from an earlier allocation, and those contents can be influenced by the attacker.

Control of freed memory content is a standard route from memory corruption to code execution, although it depends on allocator behaviour and on how the surrounding application uses memory. The advisories stop at describing the defective path. Turning it into a reliable exploit requires work that the public documents do not describe.

Exploitation conditions

The significant constraint is not authentication. It is reachability. A request has to reach a PHP code path that allocates enough memory to hit the configured limit while still inside a partially built request. Long-running upload handlers, image processing and large XML or JSON parsers are the natural candidates, and any of them that can be reached over HTTP widens the exposure.

An attacker does not need credentials, but does need a target that accepts request bodies large enough to exhaust the limit. Lower memory_limit values make the threshold easier to cross, which means hardened configurations can be more exposed to this specific abort path than generous ones.

Impact

Successful exploitation yields code execution in the context of the web server user. That is the same privilege PHP already holds, so the immediate effect is not necessarily root. In shared hosting and multi-tenant deployments it is enough to read adjacent tenants' data, reach internal services from a trusted network position, or persist through a file the application can write.

Denial of service is the lower bound. Even where code execution fails, an abort inside request parsing can leave the worker in an undefined state.

Affected versions and scope

All PHP 8.5 releases before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.35 carry the defect. PHP 8.1 and older branches are end-of-life and receive no ordinary updates from the project, which makes them affected indefinitely unless a downstream vendor maintains backports.

The fix sits in the core engine, so every runtime built from an affected source tree inherits it: distribution packages, container base images, embedded interpreters and language runtimes bundled inside appliances. Applications do not need their own patch, but they do need the interpreter underneath them rebuilt.

Exposure context

A ZoomEye search on app="PHP" returned 94,382,282 matching assets at the time of writing. That figure counts PHP-fingerprinted systems and says nothing about their patch level, so it should be read as an inventory of where the update matters rather than a count of exploitable hosts. PHP is infrastructure, and a large share of those systems sit behind content management platforms that report their own versions rather than the interpreter build.

Remediation

Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Distribution maintainers and long-term support vendors received the patches ahead of publication, so refreshing packages through the normal channel is usually the fastest route on Linux. Verify the interpreter version after the update with php -v and confirm that the running service picked up the new binary, since some deployment layouts keep an older build on disk.

For end-of-life branches, the PHP security team published minimal retrospective fixes for 7.4, 8.0 and 8.1 aimed at organisations that compile from source or lack an LTS provider. Others should plan a move to a supported branch.

Where patching has to wait, the advisories recommend isolating internet-facing PHP applications from public networks until the fix is installed and verified, and checking whether third-party software embeds its own PHP copy. The NCSC-NL repository is named as the place to look for affected products.