CVE-2026-109618
PHP
What this is
PHP can mishandle memory after running out of space to store data while processing a request. When cleaning up afterward, it may use memory that has not been properly prepared.
How it can harm you
An attacker can run their own program on the server through a network connection, without signing in or requiring anyone to interact. The attack is technically difficult and requires additional conditions that are not specified.
How urgent it is
This vulnerability is already being used in attacks. Update PHP promptly because the flaw can let an attacker run their own program on the server.
Who is affected
Affected releases are PHP 8.2.* before 8.2.35, PHP 8.3.* before 8.3.36, PHP 8.4.* before 8.4.27, and PHP 8.5.* before 8.5.12.
What to do
Update the installed PHP branch: 8.2.* to 8.2.35, 8.3.* to 8.3.36, 8.4.* to 8.4.27, or 8.5.* to 8.5.12. Consult the PHP Group advisory for mitigation guidance.
How to check your server
Find the installed PHP version and compare it with the affected and fixed releases in the PHP Group advisory.
Technical details
- CVE
- CVE-2026-109618
- Published
- October 21, 2026
- CWE
- CWE-416
- CVSS
- 9.2
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 11.6% chance of an attack attempt in the next 30 days
- Attack evidence
- attacks observed; public exploit available; public exploit on GitHub; Nuclei template
CVSS measures technical severity on a scale up to 10. Attack conditions and urgency are explained above.
EPSS estimates the chance of an exploitation attempt in the next 30 days, not the chance of your server being breached.