PHP: remote code execution through out-of-memory errors (CVE-2026-109618)
A bug in how PHP recovers from out-of-memory errors can let an attacker run code on the server. Rated 9.2. Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
What happened
On 21 October 2026, the PHP project published CVE-2026-109618, rated 9.2 (critical). When PHP runs out of memory mid-request, some code paths leave request memory uninitialised, and the cleanup that follows can read it.
The advisory says several ways of forcing out-of-memory errors trigger this reliably and can lead to remote code execution. No login is needed, though the attack is rated high complexity.
Who is affected
- Servers running PHP 8.2 below 8.2.35, 8.3 below 8.3.36, 8.4 below 8.4.27 or 8.5 below 8.5.12.
- That covers Laravel, WordPress, Symfony and plain PHP apps, including ones an AI agent wrote for you.
- Versions before 8.2 aren't listed, but they no longer get security fixes, so move off them anyway.
How to check
- On the server, run php -v. In Docker, run it inside the container: the image's PHP is what counts, not your laptop's.
- On managed hosting (shared hosting, Forge, Ploi, cPanel), look up the PHP version in the dashboard.
How to recover
- Upgrade PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or later) and restart PHP-FPM or your web server.
- In Docker, pull the latest php:8.x image, rebuild and redeploy. Pinned digests or old base images stay vulnerable.
- On managed hosting, switch to the patched version in the dashboard, or ask your host when they'll roll it out.
- If the server was exposed on an old version, rotate the secrets it could read (.env, database passwords, API keys).
Check your app
Free and read-only. Before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.