CVE-2026-109618: RCE via OOM corruption
CVE-2026-109618 is a critical (CVSS 9.2) PHP bug in out-of-memory handling that can allow unauthenticated remote code execution. It affects every supported branch before 8.2.35, 8.3.36, 8.4.27 and 8.5.12, plus all end-of-life versions. Apache mod_php is most exposed because the attack runs before any application code.
| CVE | CVE-2026-109618 |
|---|---|
| Advisory | GHSA-w8hw-w9fx-j79w |
| Published | 2026-10-21 |
| Severity | Critical CVSS v4.0 9.2 |
| Weakness | CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 |
| Fixed in | 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
| Related | CVE-2026-109619 (RCE via stale global state) — fixed in the same releases |
What it is
Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid, which can lead to unauthenticated remote code execution.
Who is most exposed
- Apache mod_php: request shutdown always runs, even after a failed startup. Confirmed RCE.
- FrankenPHP: likely susceptible, analogous to mod_php (source analysis).
- PHP-FPM: susceptible after normal startup; application-specific paths.
- LiteSpeed (LSAPI): modelled on FPM; application-specific exploits likely but unvalidated.
Red Hat rates it Important for RHEL because standard RHEL deployments use PHP-FPM rather than mod_php.
Affected and fixed versions
| Branch | Affected | Fixed in | Status |
|---|---|---|---|
| PHP 8.5 | < 8.5.12 | 8.5.12 | Fixed release available |
| PHP 8.4 | < 8.4.27 | 8.4.27 | Fixed release available |
| PHP 8.3 | < 8.3.36 | 8.3.36 | Fixed release available |
| PHP 8.2 | < 8.2.35 | 8.2.35 | Fixed release available PHP 8.2 reaches end of life on 31 December 2026. |
| PHP 8.6 | < 8.6.0RC4 | 8.6.0RC4 | Pre-release Pre-release. RC4 contains the fixes; earlier 8.6.0 builds are affected. Not for production. |
| PHP 8.1 | all | — | End of life No official release. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1; distributions and LTS vendors may ship backported packages with the same version number. |
| PHP 8.0 | all | — | End of life No official release. Source backport and vendor packages only. |
| PHP 7.4 | all | — | End of life No official release. Source backport and vendor packages only. |
Distribution packages may be fixed under an older-looking version number: see backports.
What to do
- Check your site to see which PHP version it reports.
- Confirm on the server with the self-check commands.
- Update PHP and restart every PHP worker.
- If you can’t update right away, apply the temporary mitigations.
This page intentionally contains no exploit details or proof-of-concept code.
FAQ
Is CVE-2026-109618 exploitable without logging in?
Yes. The advisory confirms unauthenticated remote code execution as the web worker account, validated over HTTP against Apache mod_php with default PHP input and memory limits.
Is PHP-FPM affected by CVE-2026-109618?
Yes, considered susceptible. FPM exits a child when request startup fails, which blocks the startup path, but out-of-memory errors after normal startup can still reach the bug. No complete FPM exploit had been demonstrated when the advisory was published.
How do I fix CVE-2026-109618?
Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or install your distribution’s patched package, then restart PHP. Setting memory_limit=-1 administratively is a partial mitigation only.