VU#763488: Memory corruption vulnerabilities in PHP

Two memory-related vulnerabilities affect PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. CVE-2026-109618 is a memory corruption vulnerability in the out-of-memory (OOM) handling mechanism triggered when an OOM condition interrupts request processing, causing cleanup routines to access invalid memory. CVE-2026-109619 is a use-after-free vulnerability in global state management where a worker retains references to freed request-owned state, allowing subsequent requests to access stale memory. Both vulnerabilities can be exploited remotely by unauthenticated attackers via crafted HTTP requests to achieve arbitrary code execution. Apache mod_php is especially vulnerable, with proof-of-concept exploits demonstrating attacks before application code execution. Vendor patches are available in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Temporary mitigations include configuration changes to memory limits, request size limits, and disabling session upload progress, but these do not fully mitigate the risk.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on affected PHP web services, compromising confidentiality, integrity, and availability of the web service and underlying infrastructure. Apache mod_php deployments are at higher risk due to demonstrated proof-of-concept exploits that can trigger attacks before application code runs.

Official patches are available in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 and should be applied immediately. Users of PHP 8.1 and older unsupported versions should seek backported fixes from LTS vendors or upgrade to supported versions. Temporary mitigations include setting memory_limit=-1 at the administrative level, lowering post_max_size and upload_max_filesize, enforcing request size limits at the web server or proxy, and disabling session.upload_progress.enabled. On PHP 8.5, setting fatal_error_backtraces=0 is recommended. These mitigations reduce exposure but do not provide complete protection. Network segmentation and running PHP with minimum necessary privileges can limit impact. Monitoring for unusual PHP process behavior is advised.