PHP Remote Code Execution (RCE) via OOM Memory Corruption (CVE-2026-109618)
Executive & SecOps Summary
SECOPS ASSESSMENTAll web applications and server environments running on the PHP engine.
Unauthenticated remote attackers can trigger Out-of-Memory (OOM) conditions to execute arbitrary code (RCE) with system privileges.
Immediately apply official PHP security patches and restrict abnormal memory allocation via php.ini configurations.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND- Apply Security Patches: Update to the latest PHP version via your OS package manager or official source.
# Example for RHEL/CentOS
sudo yum update php- Configure Memory Limits (php.ini): Restrict the maximum memory a single script can consume to prevent intentional OOM triggers.
; php.ini
memory_limit = 128M- WAF Implementation: Deploy Web Application Firewall rules to intercept and block excessively large POST requests or malformed multipart data.
Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
This vulnerability exists in the way the PHP engine utilizes the longjmp() function to handle Out-of-Memory (OOM) errors. When PHP fails to allocate memory during request processing, it uses longjmp() to abort the current context and jump to a cleanup routine. However, in certain contexts, memory remains in an uninitialized state before an allocation attempt. If an OOM occurs at this precise moment, the subsequent request cleanup procedure may read from or branch based on this uninitialized memory. Attackers can consistently trigger this condition using specific OOM strategies to manipulate memory layouts, leading to Remote Code Execution (RCE). Its inclusion in the CISA KEV list underscores the high risk of active exploitation.
Official Vendor Advisories & References
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.