Published Corrective releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, as well as patches for branches that are no longer supported PHP 7.4, PHP 8.0 and PHP 8.1, which fixed two critical vulnerabilities:
- CVE-2026-109618 is a remote code execution caused by the fact that when the free memory available to a process is exhausted, the out-of-memory handler, through the execution of the longjmp() function, can interrupt the PHP interpreter in a state where Only part of the internal structures associated with request processing has been initialized. Subsequently, the request completion function refers to these structures as already initialized, although memory is not allocated for them.
The main attack vector is manipulation of multipart requests to create conditions for exhausting the memory available to the process. To bypass the post_max_size limit, the Content-Length header may not be specified and a huge number of HTTP headers may be sent. It is also possible to carry out targeted attacks on specific operations in PHP applications that consume excessive memory. The exploit is confirmed for mod_php, as it calls the shutdown() function even when it fails. PHP-FPM will terminate the child process if it fails, which makes it difficult to carry out an attack, but theoretically does not exclude it.
- CVE-2026-109619 – remote code execution caused by accessing memory after it releases due to incorrect clearing of global state associated with a specific request. If a request is aborted due to a fatal error, timeout, or out of memory, the global state may not be reset and pointers may remain active despite freeing the memory they refer to. When the next request is processed in the same process, the remaining pointer may be accessed to the old global state.
Exploitation can be used to create out-of-memory conditions when processing a multipart request in code to indicate upload progress (session.upload_progress). At the same time, the fatal_error_backtraces handler in PHP 8.5 is mentioned as the main and confirmed attack vector, which does not reset the trace state upon completion. In the first case, an attack is possible on mod_php and PHP-FPM, and in the second only on mod_php. Also mentioned is the unconfirmed possibility of an attack in configurations that contain directives in the settings that lead to the display of warnings at an early stage of request processing (for example, warnings about the use of outdated parameters).