CVE-2026-109618: RCE via OOM corruption
Critical · CVSS 9.8 (CVSS 3.1)EPSS 100.0%, 100th percentilePublished Updated Assigner: php
Description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-1325, CWE-1419, CWE-416, CWE-755, CWE-824
Tracked companies
Amazon Web ServicesGoogle Cloud
Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.
Status incidents that name it
- · Minor · names this CVE
“[BookMyName] PHP emergency migration — multiple service regressions On 2026-10-21, a critical PHP RCE (CVE-2026-109618/109619, CVSS 9.2) forced an emergency migration of the BookMyName services. The migration introduced PHP…”
- · No impact listed · says not affected (notice says “no impact to ”)
“PHP2Shell (CVE-2026-109618, CVE-2026-109619) Status: No impact identified; review ongoing We have found no impact to Notion from PHP2Shell.…”
- · No impact listed · says not affected (notice says “not impacted”)
“…Amplitude has confirmed that no first-party Amplitude services are impacted by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell Advisory). We are working with an affected third-party vendor to establish security…”
- · No impact listed · says not affected (notice says “Not Affected”)
“PHP Security Advisory: Astro and Astro Private Cloud Not Affected; Review Custom Images PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Astronomer has conducted a thorough internal review of its code and container images and…”
- Scaleway [Serverless Functions][fr-par/nl-ams/pl-waw] Security updates applied to PHP and Node.js runtimes· Minor · names this CVE
“…updates applied to the PHP and Node.js runtimes used by Serverless Functions. --- PHP Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed…”
- · No impact listed · says not affected (notice says “no impact on ”)
“…found no impact on Zapier services or customer data. This advisory is now closed. Security FAQ: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) "1. What is this issue? Two vulnerabilities were disclosed in PHP, an open-source programming…”
- · Minor · names this CVE
“: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619. If an image in your registry still doesn't have a fixed version, contact Support. Next update by…”
- Cloudinary Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619· No impact listed · says not affected (notice says “not affected”)
“Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Regarding the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Cloudinary’s core…”
- · No impact listed · names this CVE
“…PHP Remote Code Execution Vulnerabilities We can confirm that remediation efforts for the reported vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were completed as of 20:06 UTC on October 23, 2026.We have found no evidence that these…”
- · No impact listed · names this CVE
“…Akamai has completed its assessment of the recently published PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) across our platform and infrastructure, and mitigation efforts are complete. Cloud…”
- · Maintenance · names this CVE
“The PHP project released today a fix for two critical vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5 As a…”
- · Critical · names this CVE
“The PHP project released today a fix for two critical vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5 As a…”
- · Maintenance · says not affected (notice says “unaffected”)
“Critical PHP vulnerabilities - customer action may be required Aptible is aware of the vulnerabilities CVE-2026-109618 and CVE-2026-109619 affecting PHP applications that can allow for remote code execution under certain conditions.…”
- · Minor · names this CVE
“PHP security issues CVE-2026-109618 and CVE-2026-109619 We deployed patches for the remaining PHP versions 5.6 and 7.3 on all Webhosting- and…”
- · Minor · names this CVE
“Changes to the Pingdom Public API As part of our emergency mitigation for the recently discovered PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), the Pingdom API now requires requests to include a User-Agent header. Please update your…”
Affected vendors and products
PHP Group: PHPSiemens: RUGGEDCOM APE1808
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)