Most recent entries from all

CVE-2026-109618 — RCE via OOM corruption

2026-10-21T23:51:48.940518+00:00

Affected: PHP Group PHP

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

USN-8948-1 — php8.1, php8.3, php8.5 vulnerabilities

2026-10-21T23:51:48.940596+00:00

Affected: Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3, Ubuntu:26.10: php8.5, Ubuntu:26.04:LTS: php8.5

It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618)

It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109619)