CVE-2026-109618: PHP Memory Corruption Vulnerability

According to Rapid7, on October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP[3]. Rapid7 reports that CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling[3], and that both flaws have a CVSSv4 score of 9.2[3].watchTowr reports that details leaked on social media before the planned disclosure date of October 22[1]. According to Sansec, Cloudflare reported early attacks at 07:43 UTC on October 21, before the 14:00 UTC release.[2]The PHP Group, as quoted by Plesk, says it considers the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.[4] Sansec says PHP's upload-progress handler can return freed worker memory to the client inside a PHPSESSID response cookie.[2]Rapid7 says the public proof-of-concept exploits each work only against particular setups, and that "none appears to be broadly reliable."[3] Sansec reports that the public exploits do not work against a default PHP installation.[2]According to AWS, upgrading immediately to a patched PHP release is the only complete fix: 8.5.12, 8.4.27, 8.3.36, or 8.2.35.[5] Rapid7 reports that PHP has supplied limited source backports for PHP 7.4, 8.0, and 8.1.[3]Palo Alto Networks' Cortex Xpanse says it has found over 22.6 million exposed instances potentially vulnerable[6]. watchTowr reported that as of October 22, 2026, CISA has not added either CVE to its Known Exploited Vulnerabilities catalog.[1]