CVE-2026-109618: PHP Memory Corruption Vulnerability

RBRecent Breaches Vulnerability Intelligence·Oct 26, 2026

CVSS 9.2 · Critical⚠ Actively exploited (CISA KEV)

9.2

CVSS score

Critical

Severity

Active

CISA KEV

Ransomware use

Oct 29, 2026

Patch deadline

⚠ Exploited in the wild. CISA added CVE-2026-109618 to its Known Exploited Vulnerabilities catalog on Oct 26, 2026, with a federal patch deadline of Oct 29, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Details

AffectedPHP Group · PHP

WeaknessCWE-416

CVSS base score9.2 (Critical)

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

PublishedOct 21, 2026

Added to CISA KEVOct 26, 2026

Federal patch deadlineOct 29, 2026

Known ransomware useNot documented

Check if your data is exposed →

Frequently asked questions

Is CVE-2026-109618 being actively exploited?

Yes — CISA lists CVE-2026-109618 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.

What does CVE-2026-109618 affect?

CVE-2026-109618 affects PHP Group · PHP.

How do I fix CVE-2026-109618?

Apply the vendor’s patch for the affected software. The federal patch deadline was Oct 29, 2026. Then check whether your personal data was exposed in any related breach.

References

Official records: NVD · CISA KEV

← All actively-exploited vulnerabilities