Critical RCE Vulnerability Discovered in PHP Group PHP

## Overview PHP Group has disclosed a critical vulnerability identified as CVE-2026-109618. This flaw affects PHP's handling of out-of-memory (OOM) errors. The vulnerability has a CVSS score of 9.2, indicating its high severity. ## Technical Details The issue arises when PHP uses the `longjmp()` function to exit the current context during OOM errors. In some cases, this can leave request memory in an uninitialized state before a new allocation occurs. The cleanup process for requests may then read or branch on this uninitialized memory. This behavior can be triggered by multiple OOM strategies, leading to potential remote code execution (RCE). ## Impact Exploiting this vulnerability allows attackers to execute arbitrary code on affected systems. Given the widespread use of PHP in web applications, this flaw poses a significant risk to numerous sites and services. Attackers can leverage this vulnerability to gain unauthorized access, manipulate data, or disrupt service. ## Mitigation Defenders should prioritize updating PHP to the latest version as soon as possible. Ensure that all applications using PHP are tested for compatibility with the new version. Additionally, review application code for any reliance on OOM handling that could be affected by this vulnerability. Implementing strict input validation and monitoring for unusual behavior can also help mitigate risks while updates are being applied.