Vulnerability Intelligence Report
RCE via OOM corruption
CVE-2026-109618
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
CISA KEV
Nuclei Template
CVSS Base Score
9.2
CRITICAL
EPSS Probability:99.98%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-416 ↗CWE-416 Use after free
CWE-755 ↗CWE-755 Improper Handling of Exceptional Conditions
CWE-824 ↗CWE-824 Access of uninitialized pointer
CWE-1325 ↗CWE-1325 Improperly controlled sequential memory allocation
CWE-1419 ↗CWE-1419 Incorrect Initialization of Resource
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| PHP Group | PHP | 8.2.* < 8.2.35 (affected), 8.3.* < 8.3.36 (affected), 8.4.* < 8.4.27 (affected), 8.5.* < 8.5.12 (affected) |
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
99.981%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | PHP Group · Vendor · USA |
| Reserved | 2026-10-12T21:03:58 |
| Published | 2026-10-21T13:48:34 |
| Last Updated | 2026-10-27T03:55:25 |
Community Chatter & Buzz