php security update (CVE-2026-109618)

PHP uses longjmp() to handle out-of-memory (OOM) errors by aborting the current request context. However, some contexts do not properly initialize memory after such an abort, causing request cleanup to operate on uninitialized memory. This can be triggered by multiple OOM strategies and leads to remote code execution (CVE-2026-109618). Furthermore, PHP's global state, which temporarily points into request memory, may not be reset correctly or may be repopulated after reset, causing it to reference freed memory. Subsequent requests may read or branch on this stale state before full initialization, also resulting in remote code execution (CVE-2026-109619).

Successful exploitation allows remote attackers to execute arbitrary code on affected PHP installations without authentication, potentially compromising confidentiality, integrity, and availability of the system. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability.

An official patch is available and should be applied promptly to all affected PHP versions prior to 8.3.36-1.oe2403sp4. Applying this update will remediate the remote code execution vulnerabilities. No additional vendor advisory content contradicts this guidance.