The editor asked for the kind of source-code mapping we did at secrets.sgit.ai/review: the project as layered graphs, the intent on one side and the code derived from the syntax tree on the other, with the join between them. Here the intent is the two flaws and the design of the patch; the code is what the patch changed in php-src, read from the diff by a parser rather than a model. Three layers, 54 nodes and 68 edges; walk them in the navigator, or read the map below.
Commit 3584a98bd · 389 files changed, 37 of them in the engine and bundled extensions traced here · 36 areas
CVE-2026-109618: RCE via OOM corruption An out-of-memory condition during request handling could leave request memory in an uninitialised state that later cleanup reads. CVSS v4.0 9.2. GHSA-w8hw-w9fx-j79w. CVE record
CVE-2026-109619: RCE via stale global state Global state that referenced request memory was not always reset, so a later request on the same worker could read freed memory. CVSS v4.0 9.2. GHSA-6wmf-4rv5-p3rp. CVE record
Each card is one thing the patch does, with the functions it uses and the files it changed. The text describes the remediation; how the flaw is reached is on the two flaws and the code, which this layer sits beside.
At the memory limit the allocator stops using the longjmp bailout; it queues a delayed error and lets the allocation proceed, so the fatal is raised later with request state intact.
Functions. zend_mm_check_limit, zend_mm_delayed_error
Addresses: CVE-2026-109618
Zend/zend_alloc.c +527 / -122A new memory_hard_limit_percent sets a ceiling above memory_limit; reaching it ends the worker with _exit(), leaving no cleanup to corrupt. zend_mm_panic also uses _exit now.
Functions. zend_mm_hard_limit_error · new setting memory_hard_limit_percent
Addresses: CVE-2026-109618
The queued error is handled at a VM safe point: it throws an UnwindExit that unwinds the PHP frames in order before the fatal, rather than a C longjmp across half-built state.
Functions. zend_handle_delayed_oom, zend_throw_unwind_exit
Addresses: CVE-2026-109618
Zend/zend_execute_API.c +36 / -13Shutdown and deactivate paths set freed pointers to NULL or UNDEF, 'may be accessed before php_request_startup()', so a later request cannot find stale state.
Functions. shutdown_executor, php_request_shutdown, sapi_deactivate
Addresses: CVE-2026-109619
main/SAPI.c +6 / -2main/main.c +48 / -2A new max_multipart_body_parts caps the number of parts the body parser accepts; the multipart header parser keeps only the two headers it uses and ignores duplicates; the session upload-progress callback is changed.
Functions. multipart_buffer_headers, rfc1867_post_handler · new setting max_multipart_body_parts
Addresses: CVE-2026-109619
ext/session/session.c +56 / -11main/rfc1867.c +188 / -27Allocation paths a caller can tolerate failing become 'fallible' and return NULL rather than jumping, which is what lets the new tests exercise the OOM handling at any allocation.
Functions. fallible allocation family
Addresses: CVE-2026-109618
Zend/zend_hash.c +259 / -43Zend/zend_string.c +20 / -2Zend/zend_types.h +15 / -11The patch is 389 files because the new allocation contract touched every place in the engine and the bundled extensions that used to abort on a failed allocation. The twenty largest areas:
| Area | Files | Added | Removed |
|---|---|---|---|
| Zend/ | 96 | 2932 | 268 |
| tests/ | 34 | 1109 | 1 |
| ext/standard | 52 | 1061 | 85 |
| ext/mbstring | 30 | 570 | 76 |
| ext/gd | 19 | 498 | 17 |
| ext/session | 5 | 416 | 63 |
| ext/soap | 14 | 375 | 8 |
| main/ | 7 | 345 | 50 |
| ext/zlib | 11 | 344 | 10 |
| ext/filter | 8 | 335 | 9 |
| ext/date | 17 | 326 | 122 |
| ext/exif | 8 | 318 | 23 |
| ext/zend_test | 8 | 278 | 42 |
| ext/xmlreader | 8 | 236 | 5 |
| ext/pcre | 8 | 186 | 10 |
| ext/fileinfo | 3 | 168 | 51 |
| ext/iconv | 7 | 146 | 11 |
| ext/json | 8 | 137 | 23 |
| ext/simplexml | 4 | 134 | 26 |
| ext/opcache | 7 | 113 | 11 |
The full per-file data, with the functions each hunk changed, is data/review.json and review/code/files.json, derived from git show of the commit.
git show -U0 of the fix commit: files, the functions each hunk falls in, the symbols the patch adds. Never a model, so it cannot invent a function that is not in the diff.