CVE-2026-109618 PHP Group PHP
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The…
- CVSS
- 9.2 Critical
- EPSS
- 100%
- Percentile
- 100
- Published
- 2026-10-21
- Force
- 11 of 12
- Public PoC
- 771
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
On CISA’s exploited list
PHP Memory Corruption Vulnerability
- Added
- 2026-10-26
- Federal patch deadline
- 2026-10-29
- Ransomware use
- not known
In the news
- Siemens RUGGEDCOM APE1808CISA Advisories · 2026-11-12
- Siemens Building Automation and Energy ProductsCISA Advisories · 2026-11-12
- Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)Unit 42 · 2026-10-29
- CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA Advisories · 2026-10-26