CVE-2026-109618: PHP RCE via out-of-memory corruption

What goes wrong, at the level the vendor published

On oss-security, Jakub Zelenka wrote that PHP uses longjmp() to abort request handling on out-of-memory errors, that an allocation failure can interrupt initialization while incomplete request state is already reachable, and that request shutdown may then access that invalid state, potentially allowing remote code execution. The PHP Foundation’s account matches: if a request reached memory_limit at the wrong moment, PHP could leave partially initialized internal data and later treat it as valid.

That is the mechanism description we will publish. We are not describing how to force the allocation failure.

What has been demonstrated

• oss-security: unauthenticated remote code execution has been demonstrated over HTTP against Apache mod_php, before application code executes. Source analysis also indicates FPM susceptibility, although a complete FPM exploit has not been demonstrated.
• The PHP Foundation: full remote code execution was demonstrated on Apache mod_php with default settings, before any application code runs. The Foundation also says remote code execution was confirmed on PHP-FPM through application-level code paths.
• Expel, attributing the statement to PHP: the mod_php demonstration for this CVE worked with PHP’s default input and memory limits.
• The University of Toronto advisory says attackers can force the condition with crafted multipart requests that stay within PHP’s apparent limits. We are not expanding that sentence into a procedure.

Impact

Successful exploitation, where it works, is unauthenticated remote code execution as the PHP worker’s operating-system account. Wiz and Cloudflare also describe crash and disclosure of process memory. Reach depends on build, extensions, and server layout; the University of Toronto advisory says exploit reliability varies and that PHP has validated full RCE. There is no trustworthy single “works everywhere” claim in the sources we reviewed, and no reason to wait for one before patching.

Fix

Upgrade to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 or later, and restart the workers that serve traffic. The oss-security note says updating is the only complete mitigation. Interim settings published by PHP, including memory_limit=-1 and a low post_max_size, are incomplete: the project says an underlying allocation failure can still reach the vulnerable path even if the controllable memory limit is removed. NVD’s record was reported by Tanium as published on 21 October 2026 and marked “Undergoing Analysis.” Use the PHP advisory as the operational source if NVD’s text is still catching up.