November 14, 2026

CVE Watchtower

CVE-2026-109618PHP Group PHP >= 8.2.* and Use After Free

NVD

Vulnerability Summary

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Severity Level
CRITICAL(9.2)
Published Date
Oct 21, 2026
Last Modified
Nov 5, 2026
PoC
Available(Nuclei)
Exploitation Status
ACTIVE
EPSS Score (30-Day)
100.00%Probability
Root Weakness (CWE)
CWE-416: Use After Free ↗
The product reuses or references memory after it has been freed, which can cause a crash or execution of arbitrary code.
CWE-755 ↗
See the MITRE CWE entry for the full definition of this weakness.
CWE-824: Access of Uninitialized Pointer ↗
The product accesses or uses a pointer that has not been initialized.
CWE-1325 ↗
See the MITRE CWE entry for the full definition of this weakness.
CWE-1419 ↗
See the MITRE CWE entry for the full definition of this weakness.
CVSS v4.0 Base Metrics — Score 9.2 (CRITICAL)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Attack VectorNetwork
Attack ComplexityHigh
Attack RequirementsPresent
Privileges RequiredNone
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)High
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None

Affected & Patched Versions

Affected Versions
  • PHP Group PHP >= 8.2.* and < 8.2.35
  • PHP Group PHP >= 8.3.* and < 8.3.36
  • PHP Group PHP >= 8.4.* and < 8.4.27
  • PHP Group PHP >= 8.5.* and < 8.5.12
Patched Versions
  • PHP Group PHP 8.2.35
  • PHP Group PHP 8.3.36
  • PHP Group PHP 8.4.27
  • PHP Group PHP 8.5.12

What to do

Patch now. CISA lists this flaw as exploited in the wild and set a federal remediation deadline of Oct 29, 2026.

  1. Check whether you run PHP Group PHP >= 8.2.* and and which version.
  2. Update to a patched version listed above, then confirm the new version.
  3. Review logs and exposed services for signs of earlier compromise.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA KEV Status

Listed in Known Exploited Vulnerabilities
Added: Oct 26, 2026
Remediation due: Oct 29, 2026 (deadline passed)

Timeline

  • Oct 21, 2026Published
  • Oct 26, 2026Added to CISA KEV catalog
  • Oct 29, 2026KEV remediation due date
  • Nov 5, 2026Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new PHP Group PHP >= 8.2.* and CVEsYou are reading CVE-2026-109618. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alerts

Related Coverage

External References

Data last checked: Nov 14, 2026 02:13 UTC