CVE-2026-109618

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).(CVE-2026-109618)

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).(CVE-2026-109619)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).(CVE-2026-109618)

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).(CVE-2026-109619)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).(CVE-2026-109618)

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).(CVE-2026-109619)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).(CVE-2026-109618)

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).(CVE-2026-109619)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)

• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)

• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)

• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)

• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)

• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)

• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)

• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)

• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)

• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)

• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: php: Out-of-bounds read via empty HTTP redirect Location header (CVE-2026-93682)

• php: PHP: Archive entry injection via integer overflow in TAR parser (CVE-2026-6103)

• php: PHP: Denial of Service via heap buffer overflow in SOAP client (CVE-2025-14181)

• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)

• php: php: Credential disclosure via cross-origin HTTP redirects (CVE-2026-91766)

• php: php: Information disclosure via crafted TLS server certificate (CVE-2026-91767)

• php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser (CVE-2025-1218)

• php: php: Access control bypass via partial IPv6 address comparison (CVE-2026-91768)

• php: php: Information disclosure via out-of-bounds read in stream filters (CVE-2026-92842)

• php: php: Server impersonation via Common Name fallback in TLS verification (CVE-2026-91769)

• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)

• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)

• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)

• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)
• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)
• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)
• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)
• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)
• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: php: Out-of-bounds read via empty HTTP redirect Location header (CVE-2026-93682)
• php: PHP: Archive entry injection via integer overflow in TAR parser (CVE-2026-6103)
• php: PHP: Denial of Service via heap buffer overflow in SOAP client (CVE-2025-14181)
• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)
• php: php: Credential disclosure via cross-origin HTTP redirects (CVE-2026-91766)
• php: php: Information disclosure via crafted TLS server certificate (CVE-2026-91767)
• php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser (CVE-2025-1218)
• php: php: Access control bypass via partial IPv6 address comparison (CVE-2026-91768)
• php: php: Information disclosure via out-of-bounds read in stream filters (CVE-2026-92842)
• php: php: Server impersonation via Common Name fallback in TLS verification (CVE-2026-91769)
• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)
• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
• php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

• CVE-2026-109618: fix remote code execution via state corruption after OOM bailout (GHSA-w8hw-w9fx-j79w)
• CVE-2026-109619: fix remote code execution via stale global state (GHSA-6wmf-4rv5-p3rp)

• CVE-2026-109618: fix remote code execution via state corruption after OOM bailout (GHSA-w8hw-w9fx-j79w)
• CVE-2026-109619: fix remote code execution via stale global state (GHSA-6wmf-4rv5-p3rp)

• SECURITY UPDATE: code execution via state corruption after an out-of-memory error and via stale global state
  • debian/patches/CVE-2026-109618.patch: terminate the process on memory limit and allocation overflow errors instead of unwinding, clear request globals at shutdown, disable session upload progress and keep only the Content-Disposition and Content-Type multipart part headers.
  • CVE-2026-109618
  • CVE-2026-109619

• SECURITY UPDATE: code execution via state corruption after an out-of-memory error and via stale global state
  • debian/patches/CVE-2026-109618.patch: terminate the process on memory limit and allocation overflow errors instead of unwinding, clear request globals at shutdown, disable session upload progress, keep only the Content-Disposition and Content-Type multipart part headers and start request variable arrays with one slot. Also fix array_merge_recursive() duplicating integer keys (bug #76505): for hash sub-arrays it now appends after the largest integer key, as PHP 7.1.20 and later do.
  • CVE-2026-109618
  • CVE-2026-109619

• CVE-2026-109618, CVE-2026-109619: avoid state corruption via bailout; the minimal EOL mitigation also disables session upload progress tracking (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp)

• CVE-2026-109618: stop re-entering the engine after an allocator failure in Zend/zend_alloc.c, report it and exit instead of bailing out
• CVE-2026-109619: avoid stale global state via bailout in main/rfc1867.c and ext/session/session.c, disabling the session upload-progress callback

• CVE-2026-109618: avoid heap state corruption via bailout on out-of-memory
• CVE-2026-109619: reset per-request globals that could be reused after a bailout during request startup

• CVE-2026-109618: fix code execution via state corruption after an out-of-memory error (GHSA-w8hw-w9fx-j79w)
• CVE-2026-109619: fix code execution via stale global state between requests (GHSA-6wmf-4rv5-p3rp)

• CVE-2026-109618, CVE-2026-109619: disable the session upload progress handler and harden request state after bailout
• memory_limit and allocation overflow fatals now print to stderr and terminate the process (no bailout, no shutdown functions)

• CVE-2026-109618, CVE-2026-109619: disable the session upload progress handler and harden request state after bailout
• memory_limit and allocation overflow fatals now print to stderr and terminate the process (no bailout, no shutdown functions)

• SECURITY UPDATE: remote code execution via state corruption after a bailout and via stale request-global state
  • debian/patches/CVE-2026-109618-CVE-2026-109619.patch: PHP security team's minimal mitigation for EOL branches: report allocator overflow and out-of-memory errors via zend_mm_safe_error_ex() and _exit() instead of bailing out, reset executor, SAPI and request globals on shutdown, add overflow checks to the CONCAT and FAST_CONCAT handlers, keep only the Content-Disposition and Content-Type multipart headers and ignore duplicates, and disable the session upload progress callback, in Zend/, main/, ext/session/session.c
  • CVE-2026-109618
  • CVE-2026-109619

• CVE-2026-109618: avoid heap state corruption via bailout on out-of-memory
• CVE-2026-109619: reset per-request globals that could be reused after a bailout during request startup

• CVE-2026-109618, CVE-2026-109619: disable the session upload progress handler and harden request state after bailout
• memory_limit and allocation overflow fatals now print to stderr and terminate the process (no bailout, no shutdown functions)

• SECURITY UPDATE: remote code execution via engine state corruption after bailout
  • debian/patches/CVE-2026-109618-CVE-2026-109619.patch: avoid state corruption via bailout (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp)
  • CVE-2026-109618
  • CVE-2026-109619

Two critical PHP vulnerabilities that can allow unauthenticated remote code execution have been fixed. The updated packages should be installed as soon as possible.

These are all security issues fixed in the php8-8.5.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the matomo-5.14.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php8 fixes the following issue:

Update to php 8.4.27:

• CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE (bsc#1286027).

Root has patched CVE-2026-109618 in the php7 package for Root:Alpine:3.15. Multiple fixed versions available.