PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Severity corrected from NONE to CRITICAL per Canadian Centre for Cyber Security official alert (AL26-026); added official government cybersecurity advisory details and detection/mitigation recommendations.
severitytags
via CCCS Canada
v10Tier D1h ago
Updated severity from NONE to CRITICAL, confirmed exploitAvailable=true with in-the-wild exploitation attempts observed by multiple vendors (WatchTowr, Hadrian, Patchstack, Cloudflare, Vega) at scale, and added details about exploitation attempts and researcher discovery attribution.
tags
via SecurityWeek
v9Tier D2h ago
Added clarification that CVSS rating is v4.0 scale, detailed memory disclosure capabilities (passwords, tokens, API keys, certificates), distinctions between mod_php (single-request exploit) and PHP-FPM (requires different conditions per CVE), and temporary mitigation options (memory_limit, post_max_size, request-size limits).
tags
via The Hacker News
v8Tier C2h ago
Added new context about AI-assisted vulnerability discovery, confirmed Cloudflare WAF deployment, mass web-shell exploitation expectations, and clarified that the flaws affect PHP 5.4 and later versions.
tags
via Krebs on Security
v7Tier C2h ago
Updated severity from NONE to CRITICAL, confirmed CVSSv4 score of 9.2, marked as actively exploited with independent reproduction and public exploit expected soon, and added CVE-2026-109619 details and related attack vectors including stale global state, fatal error backtrace, and session lifecycle exploitation.
severityactivelyExploitedtags
via Rapid7 Blog
v6Tier D3h ago
Article reveals vulnerability affects PHP 5 and all versions since then; introduces second CVE (CVE-2026-109619) and clarifies error-handling attack vector requiring multiple HTTP requests; confirms Windows servers are vulnerable.
affectedVersionstags
via Heise Security
v5Tier D3h ago
Updated activelyExploited to true (Cloudflare confirmed early attacks), added CWE-415 for heap use-after-free vulnerability, and added tags reflecting dual CVE nature (CVE-2026-109618 and CVE-2026-109619), active exploitation, affected server types, and official warnings from NCSC and Cloudflare.
cweIdstags
via BleepingComputer
v4Tier C4h ago
Added MITRE ATT&CK technique T1190 (Exploit Public-Facing Application), confirmed CWE-824 as primary classification (removing redundant CWEs), and added PHP2Shell campaign tag with architectural/evasion details.
mitreAttacktags
via CrowdStrike Blog
v3Tier C4h ago
Updated severity from NONE to CRITICAL as reported in the CVE documentation, and added technical detail about the uninitialized pointer aspect.
severitydescription
via VulDB
v2Tier C4h ago
Updated severity to CRITICAL, CVSS score to 9.2, confirmed exploit availability and active exploitation, added tags for PoC and government targeting.
