php security update (CVE-2026-109618)

PHP uses longjmp() to handle out-of-memory (OOM) errors by aborting the current request context. However, some contexts do not properly initialize memory after such an abort, causing request cleanup to operate on uninitialized memory. This can be exploited to achieve remote code execution (CVE-2026-109618). Furthermore, PHP's global state, which temporarily points into request memory, may not be correctly reset or may be repopulated after reset, leading to references to freed memory. This stale state can be used to trigger remote code execution (CVE-2026-109619). Both vulnerabilities affect PHP versions before 8.3.36-1.oe2403sp3 and have a CVSS 3.1 score of 9.8, indicating critical severity.

Successful exploitation of these vulnerabilities allows an unauthenticated remote attacker to execute arbitrary code on the affected system, potentially leading to full system compromise. The vulnerabilities affect the PHP interpreter embedded in Apache HTTP Server (mod_php), which is widely used for dynamically generated web content. The critical CVSS score reflects high confidentiality, integrity, and availability impacts.

A security update fixing these vulnerabilities is available. Users should upgrade PHP to version 8.3.36-1.oe2403sp3 or later to mitigate the risk. Since this is a direct code execution vulnerability, applying the official patch is the primary recommended action. No alternative mitigations or workarounds are indicated in the advisory.