> ## Content Index
> Fetch the complete content index at: https://securexion.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CVE-2026-109618 and 1 related: PHP remote code execution via use-after-free in memory management
- URL: https://securexion.com/cve-2026-109618/
- Published: 2026-10-22T03:30:00.000Z
- Updated: 2026-10-22T19:23:26.000Z
- Description: Two critical vulnerabilities in PHP's out-of-memory handling and global state management leave freed request memory accessible to subsequent requests, allowing remote code execution without authentication or user interaction. All supported PHP versions 8.2 through 8.5 are affected.
- Author: Securexion Team
- Tags: Vulnerability, Critical, #brief-2026-10-22

PHP versions 8.2 before 8.2.35, 8.3.0–8.3.35, 8.4.0–8.4.26, and 8.5.0–8.5.11 contain use-after-free flaws in memory management. The first affects longjmp() exit handlers invoked by out-of-memory conditions, leaving uninitialized request memory that the cleanup procedure may read or execute. The second affects global state that points into freed request memory after being incompletely reset. Both can be triggered across multiple requests and reliably lead to remote code execution.

| CVEs                | CVE-2026-109618 (CVSS 9.8), CVE-2026-109619 (CVSS 9.8) |
| ------------------- | ------------------------------------------------------ |
| Severity            | Critical (highest CVSS 9.8)                            |
| Actively exploited  | Not confirmed at time of writing                       |
| Weakness            | CWE-416 (use after free), CWE-755, CWE-824, CWE-1325   |
| Attack vector       | Network                                                |
| Privileges required | None                                                   |
| User interaction    | None                                                   |
| Published           | 21 Oct 2026                                            |

## How the attack works

When PHP encounters an out-of-memory condition, it uses longjmp() to abort the current request context. However, some code paths fail to initialize request memory before allocation attempts, leaving stale data in the cleanup phase. Separately, PHP maintains global pointers into request memory for performance; when this global state is not fully reset between requests or is repopulated after reset, it continues to reference freed memory. A later request that reads or branches on this stale global state before its own memory is initialized can execute attacker-controlled code.

## Who is affected

All organizations running PHP 8.2.0–8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, or 8.5.0–8.5.11 on web-facing servers, including shared hosting, API backends, and content management systems. PHP 8.1 and earlier are out of support.

**Affected products listed:**

- PHP (before 8.2.35)
- PHP (from 8.3.0, before 8.3.36)
- PHP (from 8.4.0, before 8.4.27)
- PHP (from 8.5.0, before 8.5.12)

## How to check if you're exposed

- Inventory: identify all PHP installations via \`php --version\` or web server configuration; list version numbers against the affected ranges.
- Logs: search web server error logs (Apache error.log, nginx error.log, PHP-FPM logs) for segmentation faults, memory corruption warnings, or unexpected process terminations that may indicate exploitation attempts.
- Configuration: check if memory\_limit is set low or if error\_reporting includes fatal errors; both increase the likelihood of triggering OOM conditions.
- Network: monitor inbound HTTP/HTTPS requests for unusual patterns or repeated connection spikes that might indicate reconnaissance or exploitation.

## How to fix it

- Upgrade all PHP installations to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or later patch releases in those branches) immediately.
- If your application runs on PHP 8.1 or earlier, which are no longer supported, plan a migration to a supported version (8.2 minimum) within the next update cycle.
- Test the patched PHP version in a staging environment to ensure compatibility with your application and extensions before deploying to production.
- Restart all PHP-FPM pools, web servers, and background workers (cron, queues) after patching to ensure new code is in use.

## If you can't patch yet

- As an interim measure, increase memory\_limit in php.ini to reduce the frequency of OOM conditions, though this does not eliminate the vulnerability.
- Restrict access to PHP endpoints at the firewall or reverse proxy level if they are not required to be public; use IP whitelisting or authentication gateways where feasible.
- Monitor running PHP processes for unexpected crashes or CPU spikes; configure automatic process restart on failure to limit the window of exploitation.

---

*Need help checking your exposure or patching at scale?* [*FutureOps InfoTech*](https://futureopstech.com/?ref=securexion.com) *can help.*