# CVE-2026-109618: RCE via OOM corruption

> CVE-2026-109618: RCE via OOM corruption. CVSS 9.8 (CVSS 3.1), named in 15 status incident(s).

Canonical: https://rewindex.com/cve/CVE-2026-109618
Last updated: 2026-10-23T16:26:54Z

- Published: 2026-10-21 13:48 UTC · Updated: 2026-10-23 16:26 UTC · Assigner: php
- CVSS: 9.8 (CVSS 3.1) · Severity: Critical · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS: 100.0%, 100th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-1325, CWE-1419, CWE-416, CWE-755, CWE-824

## Description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

## Affected vendors and products

- PHP Group: PHP
- Siemens: RUGGEDCOM APE1808

## Tracked companies

- [Amazon Web Services](https://rewindex.com/company/aws.md)
- [Google Cloud](https://rewindex.com/company/google-cloud.md)

## Status incidents that name it

- 2026-10-23 14:29 UTC [Scaleway: \[BookMyName\] PHP emergency migration — multiple service regressions](https://rewindex.com/company/scaleway/incidents/q2vs7c66nct2.md) (names this CVE): “\[BookMyName\] PHP emergency migration — multiple service regressions On 2026-10-21, a critical PHP RCE (CVE-2026-109618/109619, CVSS 9.2) forced an emergency migration of the BookMyName services. The migration introduced PHP…”
- 2026-10-23 00:14 UTC [Notion: PHP2Shell (CVE-2026-109618, CVE-2026-109619)](https://rewindex.com/company/notion/incidents/01M5K1RNRANQ1YWEAF2W6R0N51.md) (says not affected, matched “no impact to” elsewhere in the notice): “PHP2Shell (CVE-2026-109618, CVE-2026-109619) Status: No impact identified; review ongoing We have found no impact to Notion from PHP2Shell.…”
- 2026-10-22 19:25 UTC [Amplitude: Notice: Amplitude not impacted by recent PHP vulnerabilities](https://rewindex.com/company/amplitude/incidents/1nhs3z82vtvl.md) (says not affected, matched “not impacted” elsewhere in the notice): “…Amplitude has confirmed that no first-party Amplitude services are impacted by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell Advisory). We are working with an affected third-party vendor to establish security…”
- 2026-10-22 18:26 UTC [Astronomer: PHP Security Advisory: Astro and Astro Private Cloud Not Affected; Review Custom Images](https://rewindex.com/company/astronomer/incidents/01M5JDSVJXDAN1PQYRMY5CHP50.md) (says not affected, matched “Not Affected” elsewhere in the notice): “PHP Security Advisory: Astro and Astro Private Cloud Not Affected; Review Custom Images PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Astronomer has conducted a thorough internal review of its code and container images and…”
- 2026-10-22 15:18 UTC [Scaleway: \[Serverless Functions\]\[fr-par/nl-ams/pl-waw\] Security updates applied to PHP and Node.js runtimes](https://rewindex.com/company/scaleway/incidents/wn4wy3l5mhkq.md) (names this CVE): “…updates applied to the PHP and Node.js runtimes used by Serverless Functions. --- PHP Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed…”
- 2026-10-22 14:02 UTC [Zapier: Assessment of recently reported PHP vulnerabilities](https://rewindex.com/company/zapier/incidents/01M5HYPNNVAQQPNWSF691PS7XK.md) (says not affected, matched “no impact on” elsewhere in the notice): “…found no impact on Zapier services or customer data. This advisory is now closed. Security FAQ: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) "1. What is this issue? Two vulnerabilities were disclosed in PHP, an open-source programming…”
- 2026-10-21 22:08 UTC [Chainguard: Critical PHP vulnerabilities require updates](https://rewindex.com/company/chainguard/incidents/1098100.md) (names this CVE): “: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619. If an image in your registry still doesn't have a fixed version, contact Support. Next update by…”
- 2026-10-21 18:22 UTC [Cloudinary: Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619](https://rewindex.com/company/cloudinary/incidents/fnwd86wg4608.md) (says not affected, matched “not affected” elsewhere in the notice): “Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Regarding the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Cloudinary’s core…”
- 2026-10-21 15:03 UTC [Akamai: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities](https://rewindex.com/company/akamai/incidents/3074yp9cpd8h.md) (names this CVE): “…PHP Remote Code Execution Vulnerabilities We can confirm that remediation efforts for the reported vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were completed as of 20:06 UTC on October 23, 2026.We have found no evidence that these…”
- 2026-10-21 14:44 UTC [Linode (Akamai): Customer Security Advisory: PHP Remote Code Execution Vulnerabilities](https://rewindex.com/company/linode-akamai/incidents/wq8zlhk736fk.md) (names this CVE): “…Akamai has completed its assessment of the recently published PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) across our platform and infrastructure, and mitigation efforts are complete. Cloud…”
- 2026-10-21 14:38 UTC [Scaleway: P2 - \[WEBHOSTING\] - PHP Emergency maintenance](https://rewindex.com/company/scaleway/incidents/t6t2jbytc4gt.md) (names this CVE): “The PHP project released today a fix for two critical vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php\#2026-10-21-5 As a…”
- 2026-10-21 14:06 UTC [Scaleway: \[BookMyName\]\[Security\] Emergency maintenance - BMN services unavailable](https://rewindex.com/company/scaleway/incidents/k8yyg32ksqcy.md) (names this CVE): “The PHP project released today a fix for two critical vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php\#2026-10-21-5 As a…”
- 2026-10-21 13:04 UTC [Aptible: Critical PHP vulnerabilities - customer action may be required](https://rewindex.com/company/aptible/incidents/kj6v558f61bh.md) (says not affected, matched “unaffected” elsewhere in the notice): “Critical PHP vulnerabilities - customer action may be required Aptible is aware of the vulnerabilities CVE-2026-109618 and CVE-2026-109619 affecting PHP applications that can allow for remote code execution under certain conditions.…”
- 2026-10-21 11:04 UTC [Hetzner: PHP security issues CVE-2026-109618 and CVE-2026-109619](https://rewindex.com/company/hetzner/incidents/f4144d55-38c3-48d1-8664-7a3429355cd7.md) (names this CVE): “PHP security issues CVE-2026-109618 and CVE-2026-109619 We deployed patches for the remaining PHP versions 5.6 and 7.3 on all Webhosting- and…”
- 2026-10-20 06:30 UTC [Pingdom: Emergency Changes to the Pingdom Public API](https://rewindex.com/company/pingdom/incidents/512230.md) (names this CVE): “Changes to the Pingdom Public API As part of our emergency mitigation for the recently discovered PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), the Pingdom API now requires requests to include a User-Agent header. Please update your…”

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-109618)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-109618)
- [https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-109618 · Markdown: https://rewindex.com/cve/CVE-2026-109618.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-109618 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:15.067Z