CVE-2026-109618: PHP aborts a request on memory and leaves a hole

If the site runs on PHP, this note is about your server. On 21 October the PHP project shipped fixes for CVE-2026-109618. On 26 October CISA added it to the known-exploited catalog. PHP scored it 9.2. No login is required. The interpreter handles the request before your application code runs.

In plain language

PHP caps memory per request. Hitting the cap should stop the request cleanly and forget the half-built state. Here the stop was abrupt. Some request bookkeeping was left looking valid, and PHP could later treat it as real and run what the sender supplied. To a site owner that looks like the site suddenly executing commands. To a host it looks like a worker that misbehaves after an out-of-memory error.

What actually broke

On memory_limit PHP used to leave the handler via longjmp(), a jump out of the middle of the work. If memory ran out before the request was fully built, the structures held garbage. Shutdown could treat that garbage as initialized data. The fix drops that jump: a soft failure is deferred, and past a harder threshold the process exits instead of reading broken state.

Builds that serve web requests are in scope: mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. mod_php carries the highest risk, because the web server process is the PHP process, and the confirmed path needs no login. FPM is in scope too. A CLI php binary that the internet never reaches is not exposed by this particular bug, but it should still be updated with the rest.

What to do

• Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart every worker. A live old process is still the old bug.
• PHP 8.1 and older got no release. The project published minimal source fixes for 7.4, 8.0, and 8.1. If the host has not applied them, take the site off the internet until a backport exists.
• A WAF narrows the window. It does not close the bug. CISA is explicit: if you cannot patch, take internet-facing PHP offline.
• After the upgrade, watch whether a worker spawns shells and whether new files appear in the site tree.

The same release also fixes the second bug. A third one, session upload progress, is not fixed by those builds. Read all three rather than stopping at the first CVE in the headline.