Zero Radar
← feed
CriticalVulnerabilityCVE-2026-109618updated 29 Oct 2026, 04:15 UTC

PHP out-of-memory bug lets attackers run code on the server

Attackers can send a crafted web request that makes PHP crash its memory handling and then run their own commands on the server. Attacks on this flaw are confirmed in the wild.

Exploited (BleepingComputer, CISA KEV)Fix availableOfficial, 16 sources
SeverityCriticalCVSS 9.2 of 10
Being exploited?YesConfirmed by BleepingComputer, CISA KEV, The Record, NVD, Wiz Research, SecurityWeek, The Hacker News · 26 Oct 2026
Fix available?YesPatched PHP releases are available from PHP upstream and distributions (Ubuntu USN, Ondrej Sury PPA for PHP 5.6). Exact fixed version numbers are not stated in the provided material; PHP 5.x is out of security support, so a backported patch or upgrade is required. · since 25 Oct 2026
How sure is this?Official, 16 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted request to a public PHP server
  2. 2Memory left uninitializedOut-of-memory abort skips cleanup safely
  3. 3Cleanup reads bad memoryCorrupted state is read during request cleanup
  4. 4Code executionAttacker runs commands without logging in
  5. ResultAttacker controls the server

What happened

CVE-2026-109618 is an out-of-memory handling flaw in PHP where some contexts leave request memory uninitialized after a longjmp() abort, and later cleanup reads or branches on that memory, enabling unauthenticated remote code execution. Some sources also describe a pointer underflow in the PHP-CGI SAPI when cgi.fix_pathinfo=1.

Why it is dangerous: Successful exploitation gives attackers full control of the affected server without logging in. Public-facing PHP servers, including those at government entities and industrial vendors, are at risk; one European government attack reportedly yielded password hashes and MFA data within two hours.

Are you affected?

You are affected if you run PHP versions 5.x through 8.4.26 on an internet-facing server, especially with cgi.fix_pathinfo=1 (the default for CGI setups).

PHP 5.x through 8.4.26 (per Full Disclosure report); PHP 8.4.26 and earlier listed in one source; some industrial products from Siemens, Schneider Electric, ABB and others are also reported affected.

What to do

  1. Update PHP to a patched release from your distribution or php.net; for PHP 5.x, apply a vendor backport or upgrade to a supported version
  2. Check whether the server was compromised before patching: review logs and look for unknown processes, files, or accounts
  3. Rotate passwords and MFA secrets if exposure is suspected
  4. Set cgi.fix_pathinfo=0 if you use PHP-CGI and cannot patch immediately (mitigation per vendor guidance)

Timeline

  1. 20 Oct 2026, 21:56 UTC
    Publicly disclosed
  2. 20 Oct 2026, 21:56 UTC
    Reported by r/netsec · r/netsec
  3. 21 Oct 2026, 00:05 UTC
    Reported by PHP · PHP
  4. 21 Oct 2026, 00:14 UTC
    Reported by PHP · PHP
  5. 21 Oct 2026, 00:20 UTC
    Reported by PHP · PHP
  6. 21 Oct 2026, 00:24 UTC
    Reported by PHP · PHP
  7. 21 Oct 2026, 00:35 UTC
    Reported by PHP · PHP
  8. 21 Oct 2026, 14:17 UTC
    Reported by NVD · NVD
  9. 21 Oct 2026, 15:28 UTC
    Reported by Socket · Socket
  10. 21 Oct 2026, 15:33 UTC
    Reported by Ubuntu USN · Ubuntu USN
  11. 21 Oct 2026, 19:06 UTC
    Reported by Socket · Socket
  12. 21 Oct 2026, 21:24 UTC
    Reported by r/netsec · r/netsec
  13. 23 Oct 2026, 07:40 UTC
    Reported by The Hacker News · The Hacker News
  14. 24 Oct 2026, 22:27 UTC
    Reported by oss-security · oss-security
  15. 25 Oct 2026, 15:20 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  16. 25 Oct 2026, 15:20 UTC
    Palo Alto Networks reported on it · Palo Alto Networks
  17. 25 Oct 2026, 17:19 UTC
    Reported by The Hacker News · The Hacker News
  18. 26 Oct 2026, 00:25 UTC
    Reported by oss-security · oss-security
  19. 26 Oct 2026, 09:20 UTC
    BleepingComputer reported on it · BleepingComputer
  20. 26 Oct 2026, 09:20 UTC
    Reported by BleepingComputer
  21. 26 Oct 2026, 16:38 UTC
    Reported by oss-security · oss-security
  22. 26 Oct 2026, 18:17 UTC
    SecurityWeek reported on it · SecurityWeek
  23. 26 Oct 2026, 23:04 UTC
    CISA reported on it · CISA
  24. 26 Oct 2026, 23:09 UTC
    CISA KEV reported on it · CISA KEV
  25. 26 Oct 2026, 23:09 UTC
    Confirmed by CISA KEV
  26. 27 Oct 2026, 00:42 UTC
    Reported by oss-security · oss-security
  27. 27 Oct 2026, 04:37 UTC
    Reported by The Hacker News · The Hacker News
  28. 27 Oct 2026, 07:31 UTC
    Full Disclosure reported on it · Full Disclosure
  29. 27 Oct 2026, 08:20 UTC
    Reported by BleepingComputer · BleepingComputer
  30. 27 Oct 2026, 13:24 UTC
    The Record reported on it · The Record
  31. 27 Oct 2026, 13:54 UTC
    Wiz Research reported on it · Wiz Research
  32. 27 Oct 2026, 21:08 UTC
    Reported by oss-security · oss-security
  33. 28 Oct 2026, 12:00 UTC
    Reported by SecurityWeek · SecurityWeek
  34. 28 Oct 2026, 14:00 UTC
    Reported by BleepingComputer · BleepingComputer
  35. 28 Oct 2026, 16:02 UTC
    Reported by The Hacker News · The Hacker News
  36. 29 Oct 2026, 04:12 UTC
    Reported by Full Disclosure · Full Disclosure

Sources 30 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Security press established security newsrooms

Technical details

ID
CVE-2026-109618 · ZR-d7e589c6 · ZR-4e5f0d81 · ZR-0d8d39d2 · ZR-eb73651e
CVSS
9.2 / 10
EPSS
100% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 21:56 UTC
On Zero Radar
before the radar started
Last change
29 Oct 2026, 04:15 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

PHP out-of-memory bug lets attackers run code on the server · Zero Radar