These vulnerabilities are addressed in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Additional details and mitigations can be found in this PHP advisory: [https://www.php.net/archive/2026.php#2026-10-21-5](https://www.php.net/archive/2026.php#2026-10-21-5) as well as GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2026-109618 KEV | CWE-755 Improper Handling of Exceptional Conditions | 8.1 High |
PHP multipart/form-data insecure out-of-memory error handling PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, the code before the allocation does not properly account for a early exit and leaves reachable request memory in an uninitialized or otherwise invalid state. The request shutdown procedure may then read or branch on the uninitialized memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Application-independent, complete remote code execution has been validated over HTTP against mod_php with default PHP input and memory limits and normal prefork workers. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. CISA SSVC — Exploitation: None · Automatable: No · Impact: Total Vendor fix: Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. ↗ Affected, fixed & timelineAffected:
Fixed in:
|
| CVE-2026-109619 KEV | CWE-416 Use After Free | 8.1 High |
PHP insecure state initialization use-after-free PHP contains error handling, Session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, Session and error handling operations run before normal initialization of the next request. They can trust stale state left by the previous request before initialization has a chance to replace it, causing a use after free. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. CISA SSVC — Exploitation: None · Automatable: No · Impact: Total Vendor fix: Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. ↗ Affected, fixed & timelineAffected:
Fixed in:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
Articles from the monitored vendor research blogs and security news feeds that reference a CVE cited in this publication, or name the campaign it covers. Coverage begins when feed monitoring started; earlier articles are not indexed.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2026-109618 | 9.2 Critical | PHP Group PHP PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. |
| CVE-2026-109619 | 9.2 Critical | PHP Group PHP PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.