The fix removes longjmp() for out-of-memory errors in favour of a delayed soft OOM at the next VM safe point and a hard OOM via _exit(); the changelog line is 'Avoid state corruption via bailout'

Fact-check

A6 Established●●●●●● · Record · verdict: holds

GHSA-w8hw's Mitigation section states the mechanism in nearly these words, the php.net ChangeLog carries the exact line for all four releases, and the 7.4 branch commit carries the same title. Primary records carry all of it.

Open tickets: Finding-70.

Graded in Run-1, resting on captures up to 2026-10-22 08:15 UTC. The scale is on the fact-check page.

This fact over time

1. 2026-10-18 18:10 UTCphp-src publishes Branch PHP-7.4-CVE-2026-109618-109619
2. 2026-10-21 13:34 UTCPHP publishes RCE via OOM corruption (CVE-2026-109618)
3. 2026-10-22 08:09 UTCSaved into the evidence vault: PHP
4. 2026-10-22 08:15 UTCSaved into the evidence vault: php.net
5. 2026-10-22 08:15 UTCSaved into the evidence vault: php-src
6. 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

Where this fact appears

In the briefings for:

And on every claim.

Every version of this fact

The fix removes longjmp() for out-of-memory errors in favour of a delayed soft OOM at the next VM safe point and a hard OOM via _exit(); the changelog line is 'Avoid state corruption via bailout'
Who says it: PHP security team
Status: confirmed
Topic: technical
Sources: github-ghsa-w8hw-w9fx-j79w, php-net-changelog-8, github-php-src-branch-7.4-backport