Skip to content
brandefense.io
Request A Demo
On CISA KEVCritical

CVE-2026-109618PHP Use-After-Free

RCE via OOM corruption

Published Oct 21, 2026 · Updated Oct 22, 2026 · Also known as BIT-libphp-2026-109618, BIT-php-2026-109618, BIT-php-min-2026-109618, EUVD-2026-107260, GHSA-w8hw-w9fx-j79w, TR-26-1372

Key Facts

Patch immediately
  • CVE-2026-109618 is a critical-severity vulnerability (CVSS 9.2 v4) affecting PHP, libphp (bitnami), php-min (bitnami) and 8 more products.
  • It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Oct 21, 2026. No public exploit code is known.
  • EPSS estimates a 5.3% probability of exploitation in the next 30 days.
  • Fixed versions are available, including libphp 8.2.35, libphp 8.3.36, libphp 8.4.27.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Scores

CVSS v4

9.2

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS (30-day exploit likelihood)

5.3%

Higher than 92.5% of all scored CVEs

Exploit maturity

Exploited (KEV)

ATLAS score

79/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Oct 21, 2026

0 days after publication

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Exploited (KEV)

Public exploit code

10

Proof-of-concept links

In-the-wild evidence

9

Reports of active use

Advisories And Exploit References

Description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CIRCL KEVOct 21, 2026n/aNot reported
Industry KEV feedOct 21, 2026n/aNot reported

Affected Products

19 affected entries in total
ProductAffected versionsFixed in
PHPPHP>= 8.2.*8.2.35
libphpbitnamiSee advisory8.2.35
php-minbitnamiSee advisory8.2.35
php8.2debianSee advisory8.2.35-1~deb12u1
php8.4debianSee advisory8.4.27-1
6 more affected products in the full CVE brief

Patched Releases

libphp

8.2.35, 8.3.36, 8.4.27, 8.5.12

PHP

0:8.0.30-8.el9_8.1, 0:8.3.36-1.el10_2, 8.2.35, 8.3.36, 8.4.27, 8.5.12

php-main

8.5.12-1.hum1

php-min

8.2.35, 8.3.36, 8.4.27, 8.5.12

php-src

8.2.35, 8.3.36, 8.4.27, 8.5.12

php:7.4

8100020261021081045.f7998665

php:8.2

9080020261020145734.9

php:8.3

9080020261020115403.9

php8.2

8.2.35-1~deb12u1

php8.4

0:8.4.27-1.el10_2, 8.4.27-1, 8.4.27-1~deb13u1

Timeline

  1. Publicly disclosed

    Oct 21, 2026

  2. Added to CIRCL KEV

    Oct 21, 2026

  3. Added to Industry KEV feed

    Oct 21, 2026

  4. Last updated

    Oct 22, 2026

Weakness Type

  • CWE-416 Use After Free
  • CWE-755 Improper Handling of Exceptional Conditions
  • CWE-824 Access of Uninitialized Pointer
  • CWE-1325 Improperly Controlled Sequential Memory Allocation
  • CWE-1419 Incorrect Initialization of Resource

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2026-109618 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.

Request A Demo

More vulnerabilities

Figures as of Oct 23, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.