Technical Information

An unauthenticated attacker can exploit a memory corruption vulnerability in PHP by triggering an out-of-memory (OOM) condition during request initialization, causing improperly initialized request memory to be accessed during shutdown and potentially leading to remote code execution.

Patch release date: Oct 21, 2026
Further information on this vulnerability is available at : CVE-2026-109618