PHP PHP Use After Free

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

• Bitnami libphp0 → 8.2.35
• Bitnami php0 → 8.2.35
• Bitnami php-min0 → 8.2.35
• cpe php/php< 8.2.35
• cpe php/php< 8.3.36
• cpe php/php< 8.4.27
• cpe php/php< 8.5.12
• package unmanagedversion unspecified
• vendor PHP PHPversion unspecified

How to fix CVE-2026-109618

• Recommended remediation

  Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

• Official advisories

  • AWS Security Bulletins · aws.amazon.com
  • BSI CERT-Bund · wid.cert-bund.de
  • Canadian Centre for Cyber Security · cyber.gc.ca
  • CERT/CC Vulnerability Notes · kb.cert.org
  • CISA Cybersecurity Advisories · cisa.gov
  • Cisco Security Advisories · sec.cloudapps.cisco.com

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Technology hubs

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Related records

Linked stories and findings that share CVE identifiers or explicit correlation edges.

• Threat intelligence · discusses

  Critical Vulnerabilities in PHP Expose Flaws in Coordinated Disclosure

• Security incident · exploits

  Critical PHP Vulnerabilities Prompt Emergency Patches Amid Surge in Attacks

Timeline

Detection, updates, and resolution for this record.

1. Oct 21, 2026 · VulnCheck KEV

   Detected

   PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and le

2. Oct 21, 2026 · CISA KEV

   Known exploited

   Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

3. Oct 21, 2026 · NIST NVD

   Updated

   PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and le

4. Oct 22, 2026 · OpenSSF OSV / OSV Scanner

   Fix available

   libphp fixed in 8.2.35

5. Oct 22, 2026 · OpenSSF OSV / OSV Scanner

   Fix available

   php fixed in 8.2.35

6. Oct 22, 2026 · OpenSSF OSV / OSV Scanner

   Fix available

   php-min fixed in 8.2.35

7. Oct 22, 2026 · OpenSSF OSV / OSV Scanner

   Fix available

   libphp fixed in 8.2.35

8. Oct 22, 2026 · OpenSSF OSV / OSV Scanner

   Fix available

   php fixed in 8.2.35

9. Oct 22, 2026 · OpenSSF OSV / OSV Scanner

   Fix available

   php-min fixed in 8.2.35

10. Oct 22, 2026 · NIST NVD

    Updated

    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and le

11. Oct 23, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and le

12. Oct 23, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and le

13. Oct 23, 2026 · NIST NVD

    Updated

    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and le

Sources

• AWS Security BulletinsVendor advisoryCVE-2026-109618

  Bulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Summary: Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) allow an unauthenticated remote actor to execute code, access process-acc

  aws.amazon.com
• BSI CERT-BundGovernment advisoryCVE-2026-109618

  PHP: Mehrere Schwachstellen ermöglichen Codeausführung

  wid.cert-bund.de
• Canadian Centre for Cyber SecurityGovernment advisoryCVE-2026-109618

  Number: AL26-026 Date: October 21, 2026 Updated: October 23, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide addition

  cyber.gc.ca
• CERT/CC Vulnerability NotesGovernment advisoryCVE-2026-109618

  Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potent

  kb.cert.org
• CISA Cybersecurity AdvisoriesGovernment advisoryCVE-2026-109618

  CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 . These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installation

  cisa.gov
• Cisco Security AdvisoriesVendor advisoryCVE-2026-109618

  On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advi

  sec.cloudapps.cisco.com
• Cloudflare SecurityVendor advisoryCVE-2026-109618

  Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog

  blog.cloudflare.com
• CVE.orgVulnerability recordCVE-2026-109618

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-109618

  30-day exploitation probability 11.62%

  first.org
• Exploit DatabasePublic exploit reference52704

  Public exploit archive reference. This is not confirmation of exploitation. The exploit body is not stored here.

  exploit-db.com
• Full DisclosureThreat researchCVE-2026-109618

  Research mention from Full Disclosure. Not confirmation of exploitation.

  seclists.org
• Google Cloud Security BulletinsVendor advisoryCVE-2026-109618

  Published: 2026-10-21 Description Description Severity Notes Two remote code execution vulnerabilities were found in the open-source PHP language . While Google Cloud itself is not vulnerable, users of this language running on Google Cloud may be vulnerable. The following languag

  docs.cloud.google.com
• Gentoo GLSAVendor advisoryCVE-2026-109618

  PHP: Multiple Vulnerabilities (GLSA 202610-02) — Gentoo security

  security.gentoo.org
• JPCERT/CCGovernment advisoryCVE-2026-109618

  JPCERT コーディネーションセンター

  jpcert.or.jp
• NCSC NetherlandsGovernment advisoryCVE-2026-109618

  PHP heeft twee kritieke kwetsbaarheden verholpen. De kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt voor het uitvoeren van willekeurige code. Alle PHP-installaties die webverzoeken verwerken zijn getroffen. De kwetsbaarheid met kenmerk CVE-2026-109618 betr

  advisories.ncsc.nl
• Nuclei TemplatesDetection templateCVE-2026-109618

  CVE-2026-109618 has a public Nuclei detection template.

  github.com
• NIST NVDVulnerability recordCVE-2026-109618

  PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cle

  nvd.nist.gov
• Openwall OSS SecurityThreat researchCVE-2026-109618

  Research mention from Openwall OSS Security. Not confirmation of exploitation.

  openwall.com
• OpenSSF OSV / OSV ScannerPackage advisoryBIT-libphp-2026-109618

  RCE via OOM corruption

  osv.dev
• OpenSSF OSV / OSV ScannerPackage advisoryBIT-php-2026-109618

  RCE via OOM corruption

  osv.dev
• OpenSSF OSV / OSV ScannerPackage advisoryBIT-php-min-2026-109618

  RCE via OOM corruption

  osv.dev
• Palo Alto NetworksVendor advisoryCVE-2026-109618
  security.paloaltonetworks.com
• Patchstack DatabaseVendor advisoryCVE-2026-109618

  PHP has released the fix. Update now. PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and L

  patchstack.com
• Rapid7 Vulnerability DatabaseResearchCVE-2026-109618

  Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's pr

  rapid7.com
• Kaspersky SecurelistThreat researchCVE-2026-109618

  Research mention from Kaspersky Securelist. Not confirmation of exploitation.

  securelist.com
• Snyk Vulnerability DatabasePackage advisorySNYK-UNMANAGED-PHP-21347795

  Remote Code Execution (RCE)

  security.snyk.io
• Cisco TalosVendor advisoryCVE-2026-109618

  Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset.

  blog.talosintelligence.com
• Ubuntu Security NoticesVendor advisoryCVE-2026-109618

  USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP i

  ubuntu.com
• Palo Alto Unit 42Threat researchCVE-2026-109618

  Research mention from Palo Alto Unit 42. Not confirmation of exploitation.

  unit42.paloaltonetworks.com
• VulnCheck KEVConfirmed exploitationCVE-2026-109618

  PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cle

  vulncheck.com

References

• Reference · openwall.com
• VulnCheck exploitation evidence · api.vulncheck.com
• Reference · cert-portal.siemens.com
• Mitigation · github.com
• WEB · nvd.nist.gov
• VulnCheck exploitation evidence · previdian.com
• VulnCheck exploitation evidence · watchtowr.com
• VulnCheck exploitation evidence · fastly.com
• Third Party Advisory · wiz.io

Freshness

Last verified in this catalog Oct 23, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.