CVE-2026-109618

php/php CVE-2026-109618: critical 9.2

RCE via OOM corruption

Action: Upgrade php to 8.2.35 (8.2), 8.3.36 (8.3), 8.4.27 (8.4) or 8.5.12 (8.5) or later. Unsupported lines (8.1 and older) get no fix.

Affected

Fixed versions

Sources

• php-runtime: CVE-2026-109618
• https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

CVE-2026-109618 · published 2026-10-21T13:34:25Z · modified 2026-10-21T13:34:25Z · JSON