Actively exploited in the wild
PHP Memory Corruption Vulnerability
PHP Group - PHP · Listed in the CISA KEV since 2026-10-26. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-109618
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
PHP uses longjmp() for out-of-memory (OOM) errors, which may leave request memory in an uninitialized state before allocation. Subsequent request cleanup may read or branch on this memory, and multiple OOM strategies can consistently trigger this condition, leading to remote code execution (RCE).
Risk Assessment
Potential remote code execution on PHP servers by triggering OOM errors, which could lead to system compromise.
Recommendation
Update PHP to a patched version. Consider limiting the ability of unprivileged users to trigger OOM.
Other vulnerabilities in PHP
See all- CVE-2026-13081Unknown
This CVE has been rejected. Reason: Red Hat is not the CNA for PHP. CVE was reserved in error; the appropriate CNA should assign CVE IDs for these vulnerabilities.
- CVE-2026-13047Unknown
This CVE has been rejected. Reason: Red Hat is not the CNA for PHP. CVE was reserved in error; the appropriate CNA should assign CVE IDs for these vulnerabilities.
- CVE-2017-12934High
PHP versions 7.0.x before 7.0.21 and 7.1.x before 7.1.7 are prone to a heap use after free while unserializing untrusted data. This issue is related to the zval_get_type function in Zend/zend_types.h.
- CVE-2017-11628High
In PHP versions before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function could lead to denial of service or potentially allow executing code. This issue is relevant for PHP applications that accept untrusted input for the parse_ini_string or parse_ini_file function.
- CVE-2017-11142High
In PHP versions before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a denial of service attack by injecting long form variables, leading to excessive CPU consumption.
- CVE-2016-5399High
The bzread function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive.
- CVE-2017-6441High
The _zval_get_long_func_ex function in PHP 7.1.2 has a vulnerability that allows attackers to cause a denial of service through crafted use of 'declare(ticks=' in a PHP script, leading to a NULL pointer dereference and application crash.
- CVE-2017-7272High
PHP versions up to 7.1.11 enable potential SSRF attacks in applications that accept a hostname argument for fsockopen or pfsockopen, expecting the port number to be constrained. Due to the recognition of :port syntax, fsockopen will use the port number specified in the hostname argument instead of the port number in the second argument of the function.
- CVE-2016-10161High
The object_common1 function in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.
- CVE-2016-10158High
The exif_convert_any_to_int function in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.
Original NVD description (English source)
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS