Unauthenticated RCE over HTTP against Apache mod_php with default settings, before any application code runs

Fact-check

A6 Established●●●●●● · State · verdict: holds

GHSA-w8hw (the advisory record for CVE-2026-109618) says complete RCE was validated over HTTP against mod_php with default PHP input and memory limits, entirely before application code; oss-security and php.net repeat it. All parts carried by the primary record.

Open tickets: Contradiction-8, Finding-97.

Graded in Run-1, resting on captures up to 2026-10-22 08:14 UTC. The scale is on the fact-check page.

This fact over time

1. 2026-10-21php.net publishes Security advisory: Critical remote code execution vulnerabilities, update now
2. 2026-10-21 13:34 UTCPHP publishes RCE via OOM corruption (CVE-2026-109618)
3. 2026-10-21 14:41 UTCoss-security publishes CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption
4. 2026-10-22 08:09 UTCSaved into the evidence vault: PHP
5. 2026-10-22 08:09 UTCSaved into the evidence vault: php.net
6. 2026-10-22 08:14 UTCSaved into the evidence vault: oss-security
7. 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

Where this fact appears

In the briefings for:

And on every claim.

Every version of this fact

Unauthenticated RCE over HTTP against Apache mod_php with default settings, before any application code runs
Who says it: PHP security team (GHSA, oss-security), php.net
Status: confirmed
Topic: technical
Sources: github-ghsa-w8hw-w9fx-j79w, openwall-oss-security-2026-10-21-6, php-net-advisory