CVE-2026-109618
KEV EPSS 100.0%Working PoC, in-the-wild scanning with payloads, multi-vendor patching urgency, defender triage underway.
What: PHP out-of-memory handling via longjmp() leaves request memory uninitialized, enabling remote code execution through OOM-triggered pathways (multipart/form-data processing identified as vector); affects PHP 5.0–8.5 with incomplete patching across versions.
Why it matters: Exploit requests observed 5.5 hours before official patch; Mirai-style scanning/loader activity confirmed; production systems (Instructure/Parchment, PAN-OS management interfaces) already flagged; backports circulating for unpatched EOL branches. No KEV listing yet but in-the-wild exploitation signal is strong.
Where it's seen: Technical deep-dives on OOM vectors, PoC releases, multi-vendor triage (Cisco, Palo Alto, Instructure), security blogs, backport repositories, active scanner payloads.
RISK: CRITICAL — RCE via widespread PHP versions; active exploitation and loader distribution detected.
Description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).