AVG-2910 log
| Package | php-legacy |
| Status | Fixed |
| Severity | Critical |
| Type | arbitrary code execution |
| Affected | 8.1.13-1 |
| Fixed | 8.3.36-1 |
| Current | 8.3.36-1 [extra] |
| Ticket | None |
| Created | Wed Oct 21 14:23:48 2026 |
| Issue | Severity | Remote | Type | Description |
|---|---|---|---|---|
| CVE-2026-109619 | Critical | Yes | Arbitrary code execution | PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one... |
| CVE-2026-109618 | Critical | Yes | Arbitrary code execution | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is... |
| Date | Advisory | Package | Type |
|---|---|---|---|
| 21 Oct 2026 | ASA-202610-2 | php-legacy | arbitrary code execution |