PHP patches critical unauthenticated RCE in 8.2 through 8.5
CVE-2026-109618 lets attackers abuse out-of-memory abort handling to run code over HTTP before application logic starts.
The PHP security team has disclosed a critical remote code execution flaw in the PHP core, tracked as CVE-2026-109618 and scored 9.2 under CVSS v4.0. Unauthenticated attackers can trigger it over HTTP against Apache mod_php, achieving code execution before any application code runs.
PHP aborts request handling on out-of-memory errors with longjmp. An allocation failure can interrupt initialization while incomplete request state is already reachable. Request shutdown may then touch that invalid state, opening a path to remote code execution. Source analysis also indicates FastCGI Process Manager (FPM) susceptibility, though a complete FPM exploit has not been demonstrated.
Affected builds are PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12. Upgrading to those releases, or later ones in the same branches, is the only complete mitigation. Jakub Zelenka of the PHP security team announced the advisory.