CVE-2026-109618

Name of the Vulnerable Software and Affected Versions PHP versions prior to 8.5.12 PHP versions prior to 8.4.27 PHP versions prior to 8.3.36 PHP versions prior to 8.2.35

Description An unauthenticated remote attacker can achieve remote code execution (RCE) by sending specially crafted HTTP POST requests. The issue resides in the session.upload progress component and the memory limit handling during request parsing. PHP uses the longjmp() function to handle out-of-memory (OOM) errors to abort request handling; however, some contexts fail to properly account for this, leaving request memory in an uninitialized state. Subsequent cleanup operations may read or branch on this uninitialized memory, leading to memory corruption.

Real-world exploitation has been observed against systems using Apache mod php, where attackers used a four-stage HTTP chain to bypass ASLR (Address Space Layout Randomization) via memory disclosure and eventually execute arbitrary commands such as /bin/sh to perform reconnaissance and establish reverse callbacks using curl and wget.

Recommendations Update to PHP version 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Disable the session.upload progress feature. Set memory limit to -1 and ensure the application cannot override this setting. Reduce the post max size value. On PHP 8.5, disable fatal error backtraces.