CVE-2026-109618: PHP Use-After-Free in Memory Allocation Leads to Remote Code Execution
Multiple PHP versions contain a use-after-free vulnerability triggered by out-of-memory errors that leave request memory uninitialized, enabling remote code execution. This flaw affects PHP 7.3, 8.2, 8.3, 8.4, and 8.5 across all deployments.
PHP versions 7.3.0–8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, and 8.5.0–8.5.11 contain a use-after-free flaw in out-of-memory (OOM) error handling. When PHP encounters an OOM condition, it uses longjmp() to exit the current execution context, but some code paths fail to properly initialize request memory before allocating new resources. Subsequent request cleanup procedures may read or branch on this uninitialized memory, leading to remote code execution.
| CVE | CVE-2026-109618 |
|---|---|
| Severity | Critical (CVSS 9.8) |
| Actively exploited | Not confirmed at time of writing |
| Weakness | CWE-416 (use after free), CWE-755, CWE-824, CWE-1325 |
| Attack vector | Network |
| Privileges required | None |
| User interaction | None |
| Published | 21 Oct 2026 |
How the attack works
An attacker sends requests designed to trigger an out-of-memory condition in PHP. When this occurs, longjmp() abruptly exits the execution context, leaving request memory structures uninitialized. Later allocation routines write to or read from this corrupted memory, and cleanup procedures may execute attacker-controlled code branches. Multiple OOM strategies can reliably trigger this condition from the network without requiring authentication.
Who is affected
Any organization running PHP 7.3.0–8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, or 8.5.0–8.5.11 in web applications, microservices, or backend systems. This includes legacy PHP 7.3 deployments, currently supported PHP 8.2 and 8.3 versions, and newer PHP 8.4 and 8.5 installations.
Affected products listed:
- PHP (from 7.3.0, before 8.2.35)
- PHP (from 8.3.0, before 8.3.36)
- PHP (from 8.4.0, before 8.4.27)
- PHP (from 8.5.0, before 8.5.12)
- Siemens Ruggedcom Ape1808 Firmware
- Paloaltonetworks Pan-os (from 10.2.0, before 10.2.7)
- Paloaltonetworks Pan-os (version 10.2.7)
- Paloaltonetworks Pan-os (version 10.2.8)
- Paloaltonetworks Pan-os (version 10.2.9)
- Paloaltonetworks Pan-os (version 10.2.10)
How to check if you're exposed
- Inventory all PHP installations and document exact version numbers via php -v or phpinfo()
- Identify all PHP versions in the vulnerable ranges: 7.3.0–8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11
- Search application logs and PHP error logs for out-of-memory messages, segmentation faults, or unexpected child process spawning
- Monitor web server access logs for requests with unusually large payloads or repeated requests from the same source designed to consume memory
How to fix it
- Upgrade PHP to a patched version: 8.2.35 or later, 8.3.36 or later, 8.4.27 or later, or 8.5.12 or later, depending on your current version
- For legacy PHP 7.3 deployments: upgrade to a supported PHP 8.x version immediately; PHP 7.3 is end-of-life and will not receive patches
- Test the upgraded PHP version in a staging environment before deploying to production to ensure compatibility with existing applications
If you can't patch yet
- Implement reverse proxy or WAF rules to limit request sizes and rate-limit requests from a single source to reduce the likelihood of triggering OOM conditions
- Isolate PHP servers from untrusted networks using firewall rules or network segmentation until patching is complete
- Configure PHP memory limits conservatively and monitor memory usage to detect anomalous patterns that may indicate an attack attempt
Need help checking your exposure or patching at scale? FutureOps InfoTech can help.