CVE-2026-109618 log
| Source |
|
| Severity | Critical |
| Remote | Yes |
| Type | Arbitrary code execution |
| Description | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it is fully initialized. If any allocation fails at that point, PHP does not properly account for the early exit and leaves the request memory in an invalid state. The failed allocation does not need to be related to the invalid memory. The request shutdown procedure may then read or branch on it. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-2910 | php-legacy | 8.1.13-1 | 8.3.36-1 | Critical | Fixed | |
| AVG-2909 | php | 5.3.0-1 | 8.5.12-1 | Critical | Fixed |
| Date | Advisory | Group | Package | Severity | Type |
|---|---|---|---|---|---|
| 21 Oct 2026 | ASA-202610-2 | AVG-2910 | php-legacy | Critical | arbitrary code execution |
| 21 Oct 2026 | ASA-202610-1 | AVG-2909 | php | Critical | arbitrary code execution |
| References |
|---|
https://www.php.net/archive/2026.php#2026-10-21-4 https://www.php.net/archive/2026.php#2026-10-21-5 https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w |