cyfenced.com →

[ CVE-2026-109618 · Published 21 Oct 2026 ]

Out-of-memory handling flaw in PHP can lead to remote code execution

CVSS 9.8 EPSS 5%7 agency advisoriesFix available

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.8
  • Urgent advisory from BSI, CERT-EU, CERT-FR, NCSC-NL, NCSC-UK
  • Interim mitigation published by PrivacySafe

[ Analyst view ]Is this a red alert for you?

Patch within days

It is critical and reachable over the network without credentials, but our sources do not report exploitation yet.

Red alert if
Exploitation is reported for this flaw, or you run public PHP applications on an affected version that you cannot patch this week.
Can wait if
You do not run PHP, or your PHP 8.x is already on the fixed release.
What it is
PHP does not always clean up request memory correctly after an out-of-memory error, and the cleanup step can then act on uninitialised memory. Several ways of triggering out-of-memory conditions make this reliable enough for remote code execution. PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12 are affected.
Impact
A remote attacker without an account could run code on a web server that runs PHP, with no user action. Because PHP runs a large share of websites, shops and intranet applications, a working exploit would put customer data, credentials stored in the application and the server itself at risk.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker sends requests to a PHP application that drive it into out-of-memory conditions.
  2. T1059 Command and Scripting InterpreterMemory corruption is turned into code running as the web server user.
  3. T1505.003 Server Software Component: Web ShellA web shell is a typical way to keep access to a compromised web server.
  4. T1552 Unsecured CredentialsDatabase passwords and API keys in the application's configuration are read.

What to do

  1. Upgrade PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, using your distribution's packages or php.net.
  2. Restart PHP-FPM or the web server after the upgrade so the new version is actually running.
  3. If you cannot upgrade straight away on Debian or Ubuntu with PHP-FPM, apply the PrivacySafe PHP2Shell interim mitigation linked on this page.
  4. Ask your hosting provider to confirm the fixed version if your sites run on shared or managed hosting.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

[ Fixes ]Fixes and patches

  • PHP2ShellInterim mitigation · PrivacySafe · Interim mitigation for PHP-FPM 7.0 through 8.5 on Debian/Ubuntu/Trisquel and derivatives
  • Security bulletin: PHPVendor patch or bulletin · CERT-FR · php.net/index.php, cited by CERT-FR CERTFR-2026-AVI-1359
  • Statement by PHPVendor patch or bulletin · CERT-FR · php.net/archive/2026.php, cited by CERT-FR CERTFR-2026-ALE-014

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1360

    Multiple vulnerabilities in Cisco products Translated from French

    Multiple vulnerabilities have been discovered in Cisco products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2026-20356CVE-2026-76481CVE-2026-76524+23 more CVEs
  • CERT-EUCERT-EU 2026-018

    Critical Vulnerabilities in PHP

    On 20 October 2026, the PHP project announced an upcoming security release addressing two critical vulnerabilities in PHP. Public reports indicated that these vulnerabilities could lead to remote code execution. The PHP…

    CriticalCVE-2026-109618CVE-2026-109619
  • NCSC-NLNCSC-2026-0443

    Vulnerabilities fixed in PHP Translated from Dutch

    Probability/damage H/HCVE-2026-109618CVE-2026-109619
  • NCSC-UK

    Critical security issue affecting PHP

    Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

    CVE-2026-109618CVE-2026-109619
  • CERT-FRCERTFR-2026-AVI-1359

    Multiple vulnerabilities in PHP Translated from French

    Multiple vulnerabilities have been discovered in PHP. They allow an attacker to cause remote arbitrary code execution.

    CVE-2026-109619CVE-2026-109618
  • CERT-FRCERTFR-2026-ALE-014

    [Update] Multiple vulnerabilities in PHP Translated from French

    [Update of 22 October 2026] CERT-FR is aware of proofs of concept for vulnerabilities CVE-2026-109618 and CVE-2026-109619 for specific PHP deployments. [Update of 21 October 2026] The security patches are available on…

    AlertCVE-2026-109619CVE-2026-109618
  • BSI CERT-BundWID-SEC-2026-4055

    PHP: Multiple vulnerabilities allow code execution Translated from German

    Risk criticalCVE-2026-109618CVE-2026-109619

[ References ]References