Memory corruption vulnerabilities in PHP
Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potentially achieve arbitrary code execution. Description PHP is a widely used open-source scripting language designed for web development and server-side applications. It powers millions of websites and web applications worldwide and can be deployed through a variety of server configurations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. CVE-2026-109618 : A memory corruption vulnerability exi
Read at CERT/CC Vulnerability Notes
- Vendor
- PHP
- Product
- PHP
- EPSS
- 1.00 (p100)
- Exploitation
- public exploit code reported
- Exposure class
- Web platform
Why it ranks 53 (High)
- Public exploit code reported
- EPSS 1.00 (high probability of exploitation)
- Product class: web platform
- Covered by 34 independent sources
- CERT coordination
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- CERT/CC Vulnerability Notes (kb.cert.org)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.