PHP's memory_limit Was the Attack Surface: Two Critical RCEs Hide in the Out-of-Memory Path

Thu, 22 Oct 2026 08:30:00 +0530

On 2026-10-21 the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two unauthenticated remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4 9.2. Patching is the whole answer. The interesting part is the mechanism, because it explains why the interim advice contradicts what most of us configure by habit: the guard that limits memory is what gets exploited.

A limit that works by jumping out

PHP enforces memory_limit with longjmp(). When an allocation crosses the limit, execution leaves the current context at once, skipping whatever was in the middle of being set up. The advisory for CVE-2026-109618 states the consequence directly: in some contexts request memory is reachable before it is fully initialised, PHP does not account for the early exit, and request shutdown “can read or branch on the invalid memory.” The failed allocation does not need to be related to the half-built structure. Any allocation that trips the limit at the wrong moment is enough.

Php on Kuldeep Pisda

PHP's memory_limit Was the Attack Surface: Two Critical RCEs Hide in the Out-of-Memory Path

A limit that works by jumping out#

A limit that works by jumping out