PHP released 8.2.35, 8.3.36, 8.4.27 and 8.5.12 to fix CVE-2026-109618, which the PHP project rates Critical (CVSS v4 9.2) and says allows unauthenticated remote code execution through memory corruption during out-of-memory handling. watchTowr reports exploitation in the wild via its honeypots and Cloudflare reports attack traffic; CISA has not listed it in KEV.
Affected: PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12 serving web requests. PHP 8.1 and older get no upstream fix.
Fix: Upgrade to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restart all workers.
Updated Oct 21, 2026. Changed: Added watchTowr and Cloudflare exploitation reports; not in CISA KEV.
AI-written summary, Oct 21, 2026Confirm details in the vendor advisory before acting.Source: GitHub
Description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
