Source · cve · primary · captured

CVE-2026-109618: RCE via OOM corruption

CVE Program (CNA: PHP Group) · https://www.cve.org/CVERecord?id=CVE-2026-109618 · published 2026-10-21T13:48:34.845Z · added by collector-primary · slug cve-cve-2026-109618

CVE record JSON in raw/ (cveawg API). dateReserved 2026-10-12T21:03:58Z, datePublished 2026-10-21T13:48:34Z, dateUpdated 2026-10-21T16:07:52Z at fetch. CISA ADP SSVC at 14:34Z: Exploitation none, Automatable no, Technical Impact total.

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026…CISA has not observed exploitation; neither CVE is in the …Triggering the bug is much easier than turning it into cod…2026-10-12 21:03:58 UTC: CVE-2026-109618 and CVE-2026-1096…2026-10-21 13:48:34 UTC: The CVE record for CVE-2026-10961…2026-10-21 14:34 UTC: CISA's ADP assessment on both CVE re…9.2 CVSS v4.0, each CVECVE record

What it says, as the collector read it

CVE-2026-109618 (cve.org record): notes

  • Page captured 08:12Z; raw/cveawg-api.json is the full CVE JSON 5.2 record, fetched 08:11Z.
  • CNA: PHP Group (assignerShortName "php"). Title "RCE via OOM corruption".
  • Description (verbatim): "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)."
  • Affected: 8.2.* lessThan 8.2.35; 8.3.* lessThan 8.3.36; 8.4.* lessThan 8.4.27; 8.5.* lessThan 8.5.12; defaultStatus "unaffected".
  • CVSS v4.0 9.2, AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
  • Reserved 2026-10-12T21:03:58Z; published 2026-10-21T13:48:34Z.
  • CISA ADP (Vulnrichment) SSVC 2026-10-21T14:34:39Z: Exploitation "none", Automatable "no", Technical Impact "total". ADP reference: https://www.wiz.io/blog/php2shell-php-rce.
  • Odd: defaultStatus "unaffected" means 7.4-8.1 read as unaffected in the record, though php.net published backports for 7.4/8.0/8.1 (see the oss-security reply from Greenbone).

Claims that cite it

ClaimWho says itStatusPrimarySources
Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35PHP Group (CNA), GitHub advisories, php.netconfirmed5/5CVE record CVE record PHP PHP php.net
CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog
Catalog version 2026.10.21 fetched 2026-10-22T08:15Z, 1,754 entries. A point-in-time negative finding.
CISAconfirmed3/3CISA CISA CVE record
Triggering the bug is much easier than turning it into code execution; the CVSS vector says attack complexity high
Fastly: 'most deployments may be safe from RCE. Do not assume this holds true for you.' Imperva: five demonstrated techniques, three via session upload progress; about 67 KB of memory disclosed per attack.
Imperva; Fastly; the CVE recordconfirmed3/3Imperva Threat Research Fastly CVE record

Events that cite it

WhenEventTime is
2026-10-12 21:03:58 UTCCVE-2026-109618 and CVE-2026-109619 are reserved.stated
2026-10-21 13:48:34 UTCThe CVE record for CVE-2026-109618 is published; CVE-2026-109619 follows at 13:54:43Z.stated
2026-10-21 14:34 UTCCISA's ADP assessment on both CVE records: exploitation none, automatable no, technical impact total.stated

Numbers from this source

FigureOfStatus
9.2CVSS v4.0, each CVEconfirmed

Exploitation signals from this source

The bytes

capture 20261022T081218Z · HTTP 200 · https://www.cve.org/CVERecord?id=CVE-2026-109618
  • headers.json 58be2c1dc484c3910605b35d9e612014fc4b6e0c9de9f605d6286d788fde6c7a 1,500 bytes
  • page.html a112001fc560b257188b1628cf8f547b421b7bb934cbd574254375a26151ab50 880 bytes
  • provenance.json adc09f106ba451478b387bb819c13df4cc15e0ac6f7ab6507a24175c8cc75458 952 bytes
  • rendered.html 37b9582087865e1776a98adadf13b2fd1cda169569affa0d7e113500697e5edb 146,271 bytes
  • screenshot.png bfb16ac90b930eabd692ee995fc41e848022b6b3ad486b96eaab255d08553229 341,195 bytes
  • text.txt f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b 3,115 bytes
raw, 1 files with SHA256SUMS
  • cveawg-api.json f856138e139c216e7b499d86b519d6371b92494c7d63fcccbcd79117102750a1

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →