Source · advisory · primary · captured

RCE via OOM corruption (CVE-2026-109618)

PHP (php/php-src GitHub security advisory, published by bukka) · https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w · published 2026-10-21T13:34:25Z · added by collector-primary · slug github-ghsa-w8hw-w9fx-j79w

CVSS v4 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Affected <8.2.35, <8.3.36, <8.4.27, <8.5.12. CWE-416/755/824/1325/1419. GitHub REST API was blocked for this session (repo not attached), so no JSON; timestamp from the page's relative-time element.

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026…Unauthenticated RCE over HTTP against Apache mod_php with …Remote code execution is confirmed on PHP-FPMThe fix removes longjmp() for out-of-memory errors in favo…OpenAI independently reported the same root cause on 11 Au…The GitHub advisories credit four reporters: lcfr-hax (Cal…The fixes were released at 14:00 UTC on 21 OctoberBoth bugs are in the C engine, not in PHP code: the alloca…2026-10-21 13:34:13 UTC: GHSA-6wmf-4rv5-p3rp (CVE-2026-109…9.2 CVSS v4.0, each CVEPHP

What it says, as the collector read it

GHSA-w8hw-w9fx-j79w (CVE-2026-109618): notes

  • URL: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w. Title "RCE via OOM corruption". "Critical bukka published". Page time element: 2026-10-21T13:34:25Z. Captured 2026-10-22T08:09Z.
  • GitHub REST API (repos/php/php-src/security-advisories/..., /advisories/...) was refused for this session (repository not attached), so no JSON was saved.

Key facts (verbatim)

  • Affected versions: "< 8.2.35 / < 8.3.36 / < 8.4.27 / < 8.5.12". Patched: "8.2.35 8.3.36 8.4.27 8.5.12".
  • Severity "Critical 9.2 / 10", "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N". CVE ID "CVE-2026-109618".
  • Weaknesses: CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419.
  • Credits: reporters lcfr-hax, sagitzadik-wiz, tomash-areion, amyb-oai; remediation developers arnaud-lb, iluuu1994, bukka, ndossche.
  • Class: "PHP uses longjmp() for out-of-memory (OOM) errors ... leaves the request memory in an invalid state ... lead to remote code execution (RCE)."
  • SAPIs: mod_php unconditionally runs request shutdown even when startup failed: "This happens entirely before any application-specific code begins execution." FPM: "susceptible, though no complete FPM exploit has been demonstrated for this SAPI." FrankenPHP "likely susceptible"; LSAPI "application-specific exploits being likely but unvalidated".
  • Fix: removes longjmp() for OOM; "delayed, graceful soft OOM" at next VM safe point plus hard OOM via _exit() at a higher threshold.
  • "Complete remote code execution was validated over HTTP against mod_php with default PHP input and memory limits".

Contradiction

  • The Foundation blog says RCE "was also confirmed on PHP-FPM through application-level code paths"; this GHSA says "no complete FPM exploit has been demonstrated for this SAPI". (Possibly the blog conflates with the 109619 session path validated on FPM.)
  • The reporter handle "tomash-areion" is not named in the Foundation's thanks list.

Claims that cite it

ClaimWho says itStatusPrimarySources
Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35PHP Group (CNA), GitHub advisories, php.netconfirmed5/5CVE record CVE record PHP PHP php.net
Unauthenticated RCE over HTTP against Apache mod_php with default settings, before any application code runsPHP security team (GHSA, oss-security), php.netconfirmed3/3PHP oss-security php.net
Remote code execution is confirmed on PHP-FPM
GHSA-w8hw (CVE-2026-109618): 'no complete FPM exploit has been demonstrated for this SAPI'. The Foundation blog: RCE 'was also confirmed on PHP-FPM through application-level code paths'. GHSA-6wmf (CVE-2026-109619): session lifecycle RCE 'validated against mod_php and FPM'. The accounts may refer to different CVEs.
PHP Foundation blog; GHSA-6wmf for the session pathdisputed4/4PHP Foundation PHP PHP oss-security
The fix removes longjmp() for out-of-memory errors in favour of a delayed soft OOM at the next VM safe point and a hard OOM via _exit(); the changelog line is 'Avoid state corruption via bailout'PHP security teamconfirmed3/3PHP php.net php-src
OpenAI independently reported the same root cause on 11 August, with further vectors on 18 September
The GitHub advisories credit amyb-oai among four reporters. OpenAI's own post credits Calif's discovery 'using GPT-5.6 Sol' and Wiz; an X Community Note disputes OpenAI's role.
PHP Foundationreported2/2PHP Foundation PHP
The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-oai (OpenAI) and tomash-areion
tomash-areion is not named in the PHP Foundation's thanks and appears nowhere else on this beat.
GitHub security advisoriesconfirmed2/3PHP PHP Daubois
The fixes were released at 14:00 UTC on 21 October
CERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times.
php.net pre-announcement; Daubois; CERT-FR (16:00 Paris)disputed7/8oss-security Daubois CERT-FR CERT-EU php-src PHP php-src php.net
Both bugs are in the C engine, not in PHP code: the allocator's longjmp-based bailout on out-of-memory, and request globals that survive a failed request
The fix replaces bailout with a delayed error and an UnwindExit at a safe point, adds a hard limit that _exits, and resets the globals. See the code page.
php/php-src fix commit; the GitHub advisoriesconfirmed3/3php/php-src , read from a clone PHP PHP

Events that cite it

WhenEventTime is
2026-10-21 13:34:13 UTCGHSA-6wmf-4rv5-p3rp (CVE-2026-109619) and, twelve seconds later, GHSA-w8hw-w9fx-j79w (CVE-2026-109618) are published by bukka.stated

Numbers from this source

FigureOfStatus
9.2CVSS v4.0, each CVEconfirmed

The bytes

capture 20261022T080901Z · HTTP 200 · https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
  • headers.json a5b68bac81984833a0df448856c563c0abaaf285f4eac25b6fc9a01c0b4d705f 5,447 bytes
  • page.html f429f17d81fee9dced4234a3f88772e1a7fdb87170b5bf5e3c6a016758b2a14e 212,571 bytes
  • provenance.json bb24fb081f4677b9fb91aac8bf728da3b708aec4d694572ccf432df9c0e5162b 1,035 bytes
  • rendered.html 79647ef8c491692c787e535f84364db88577ccdd26a84a066643ac2d8f0a1110 214,403 bytes
  • screenshot.png 4e10459ced9f68c1f9fb25ce9f8c603fad05b9e1981b2b9de3c10c16ade86d77 535,897 bytes
  • text.txt 84ab95d3b1d538ba0ff48d9f7371e482501999c23847fbecb67de6840324bfc4 6,692 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →