CVE-2026-109618

PHP is the engine that runs behind the scenes on a huge number of websites, including online stores and business sites. This bug is like a safety valve that fails during a power surge: when the server runs low on memory, PHP's emergency shutdown procedure can leave things in a broken state that an attacker can exploit to seize control of the whole server. Attackers don't need a password or any help from a visitor — they just send the right kind of traffic to trigger it.

This matters to you if your website, web application, or any custom software your business relies on runs on PHP — this includes many content management systems, e-commerce platforms, and custom-built business sites. It affects any PHP installation older than the fixed versions, and the attack is sent over the network with no login or user action required, so it's a risk for any internet-facing PHP site.

Attackers are already exploiting this flaw, with Cloudflare detecting real attack traffic and government websites in Europe going offline as a result — this is active, confirmed exploitation, not a theoretical risk. Because no login is needed and the attack travels over the normal network connection to your website, any unpatched PHP server exposed to the internet is a live target right now. Treat this as urgent: get the patched version deployed as soon as possible, not on your next routine maintenance cycle.

1. Identify the PHP version in use across all production and staging servers (php -v, or ask your hosting provider/PaaS).
2. Confirm exposure: any PHP instance handling untrusted network requests (web server, API) is in scope, since the attack vector is network-based and requires no authentication or user interaction — the only precondition is that the application can be driven into an out-of-memory (OOM) condition, which is attacker-controllable.
3. Upgrade to the fixed version for your branch: 8.2.35 (8.2.x), 8.3.36 (8.3.x), 8.4.27 (8.4.x), or 8.5.12 (8.5.x). These are patch releases, so breaking changes should be minimal, but test critical application paths after upgrading.
4. If immediate patching isn't feasible, consult the GitHub Security Advisory for interim mitigation strategies (e.g., memory_limit tuning or WAF rules); note Cloudflare has already deployed WAF rules against observed attack traffic, so a WAF in front of the application may reduce exposure as a stopgap, not a substitute for patching.
5. Not in CISA KEV at this time, so there is no federal remediation deadline, but active exploitation reported by Cloudflare and incidents affecting European government sites since 2026-10-21 warrant emergency-change-process treatment.
6. Monitor for anomalous memory-exhaustion patterns, unexpected process crashes/restarts, and outbound connections or new processes spawned from the PHP worker/web server process after patching, as indicators of prior exploitation attempts.

Severity is high given confirmed RCE capability; exploitation is confirmed in the wild (reported by Cloudflare, first reported 2026-10-21) rather than merely predicted, so this supersedes any EPSS-based likelihood scoring — EPSS should not be weighted here. No public exploit code is on record and the CVE is not currently in CISA KEV. Weakness types involved: CWE-416 (use-after-free), CWE-755 (improper handling of exceptional conditions), CWE-824 (access of uninitialized pointer), CWE-1325 (improperly controlled sequential memory allocation), and CWE-1419 (incorrect resource initialization) — collectively stemming from PHP's longjmp()-based OOM recovery path leaving request memory uninitialized or freed before a subsequent allocation/read during cleanup. Attack vector is network, no authentication or user interaction required; attacker must reliably induce OOM during request processing, which the findings indicate is achievable via multiple strategies.