# Source: CVE-2026-109618: RCE via OOM corruption

CVE Program (CNA: PHP Group): what it says, the claims and events that cite it, and the hashes of every captured file.

Source · cve · primary · captured

# CVE-2026-109618: RCE via OOM corruption

**CVE Program (CNA: PHP Group)** · [https://www.cve.org/CVERecord?id=CVE-2026-109618](https://www.cve.org/CVERecord?id=CVE-2026-109618) · published 2026-10-21T13:48:34.845Z · added by `collector-primary` · slug `cve-cve-2026-109618`

CVE record JSON in raw/ (cveawg API). dateReserved 2026-10-12T21:03:58Z, datePublished 2026-10-21T13:48:34Z, dateUpdated 2026-10-21T16:07:52Z at fetch. CISA ADP SSVC at 14:34Z: Exploitation none, Automatable no, Technical Impact total.

## What it says, as the collector read it

#### CVE-2026-109618 (cve.org record): notes

- Page captured 08:12Z; raw/cveawg-api.json is the full CVE JSON 5.2 record, fetched 08:11Z.

- CNA: PHP Group (assignerShortName "php"). Title "RCE via OOM corruption".

- Description (verbatim): "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)."

- Affected: 8.2.* lessThan 8.2.35; 8.3.* lessThan 8.3.36; 8.4.* lessThan 8.4.27; 8.5.* lessThan 8.5.12; defaultStatus "unaffected".

- CVSS v4.0 9.2, AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

- Reserved 2026-10-12T21:03:58Z; published 2026-10-21T13:48:34Z.

- CISA ADP (Vulnrichment) SSVC 2026-10-21T14:34:39Z: Exploitation "none", Automatable "no", Technical Impact "total". ADP reference: https://www.wiz.io/blog/php2shell-php-rce.

- Odd: defaultStatus "unaffected" means 7.4-8.1 read as unaffected in the record, though php.net published backports for 7.4/8.0/8.1 (see the oss-security reply from Greenbone).

## Claims that cite it

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 | PHP Group (CNA), GitHub advisories, php.net | confirmed | 5/5 | [CVE record](../../sources/cve-cve-2026-109618/index.html) [CVE record](../../sources/cve-cve-2026-109619/index.html) [PHP](../../sources/github-ghsa-w8hw-w9fx-j79w/index.html) [PHP](../../sources/github-ghsa-6wmf-4rv5-p3rp/index.html) [php.net](../../sources/php-net-advisory/index.html) |
| CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalogCatalog version 2026.10.21 fetched 2026-10-22T08:15Z, 1,754 entries. A point-in-time negative finding. | CISA | confirmed | 3/3 | [CISA](../../sources/cisa-alert-php-20261021/index.html) [CISA](../../sources/cisa-kev-json/index.html) [CVE record](../../sources/cve-cve-2026-109618/index.html) |
| Triggering the bug is much easier than turning it into code execution; the CVSS vector says attack complexity highFastly: 'most deployments may be safe from RCE. Do not assume this holds true for you.' Imperva: five demonstrated techniques, three via session upload progress; about 67 KB of memory disclosed per attack. | Imperva; Fastly; the CVE record | confirmed | 3/3 | [Imperva Threat Research](../../sources/imperva-blog-php2shell/index.html) [Fastly](../../sources/fastly-blog-php2shell/index.html) [CVE record](../../sources/cve-cve-2026-109618/index.html) |

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-10-12 21:03:58 UTC | CVE-2026-109618 and CVE-2026-109619 are reserved. | stated |
| 2026-10-21 13:48:34 UTC | The CVE record for CVE-2026-109618 is published; CVE-2026-109619 follows at 13:54:43Z. | stated |
| 2026-10-21 14:34 UTC | CISA's ADP assessment on both CVE records: exploitation none, automatable no, technical impact total. | stated |

### Numbers from this source

| Figure | Of | Status |
|---|---|---|
| 9.2 | CVSS v4.0, each CVE | confirmed |

### Exploitation signals from this source
- [2026-10-21 14:34 UTC](../../exploitation/index.html): Exploitation: none. Automatable: no. Technical impact: total.

## The bytes
capture 20261022T081218Z · HTTP 200 · https://www.cve.org/CVERecord?id=CVE-2026-109618- `headers.json` 58be2c1dc484c3910605b35d9e612014fc4b6e0c9de9f605d6286d788fde6c7a 1,500 bytes
- `page.html` a112001fc560b257188b1628cf8f547b421b7bb934cbd574254375a26151ab50 880 bytes
- `provenance.json` adc09f106ba451478b387bb819c13df4cc15e0ac6f7ab6507a24175c8cc75458 952 bytes
- `rendered.html` 37b9582087865e1776a98adadf13b2fd1cda169569affa0d7e113500697e5edb 146,271 bytes
- `screenshot.png` bfb16ac90b930eabd692ee995fc41e848022b6b3ad486b96eaab255d08553229 341,195 bytes
- `text.txt` f8705d8e0aa2a2488fd26ae277c71e7f460465f1c2566805b29408d46c08db4b 3,115 bytes
raw, 1 files with SHA256SUMS- `cveawg-api.json` f856138e139c216e7b499d86b519d6371b92494c7d63fcccbcd79117102750a1

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/cve-cve-2026-109618/index.html