PHP Memory Corruption Vulnerability (CVE-2026-109618)
Critical · CVSS 9.8 (NVD) · fetched 2026-10-26 CISA KEV
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
Remediation
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).
Affected PHP branches
PHP 8.2 → fixed in 8.2.35, PHP 8.3 → fixed in 8.3.36, PHP 8.4 → fixed in 8.4.27, PHP 8.5 → fixed in 8.5.12, PHP <8.2 → end-of-life — no fixed release; branch upgrade required
Source: CISA Known Exploited Vulnerabilities Catalog · retrieved 2026-10-26T20:20:15-04:00 · https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json