CVE-2024-11235 is a use-after-free vulnerability in PHP's reference counting mechanism during the php_request_shutdown process. It occurs in PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5 when certain code sequences involving the __set handler or the null coalescing assignment operator (??=) and exceptions are executed. An attacker who can influence memory layout by supplying crafted inputs to a PHP script may exploit this flaw to achieve remote code execution. Red Hat has released patches for affected PHP packages in Red Hat Enterprise Linux 9 to mitigate this issue.

The vulnerability allows a remote attacker to potentially execute arbitrary code by exploiting a use-after-free condition in PHP's shutdown sequence. This could lead to full system compromise if exploited successfully. No known exploits in the wild have been reported at this time.

A patch is available and should be applied promptly. Red Hat has released updated PHP packages (e.g., php-8.3.19 and php-8.4.5) that fix this vulnerability. Users should update to these or later versions to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.