php security update (CVE-2026-109618)

PHP uses longjmp() to handle out-of-memory (OOM) errors by aborting the current request context. However, some contexts do not properly initialize memory after such an abort, leaving request memory in an uninitialized state. During request cleanup, this uninitialized memory may be read or used in control flow decisions, which can be exploited to achieve remote code execution (CVE-2026-109618). Additionally, PHP's global state may temporarily point to request memory that has been freed or not properly reset, allowing subsequent requests to access stale memory references. Multiple exploitation strategies exist to trigger these conditions, resulting in remote code execution. This vulnerability affects PHP versions before 8.0.30-18.oe2203sp4 and has a CVSS 3.1 score of 9.8, indicating critical severity.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the affected system, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the PHP environment and any systems running vulnerable PHP versions.

An official patch is available for this vulnerability. Users should upgrade PHP to version 8.0.30-18.oe2203sp4 or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.