CVE-2026-109618 is the out-of-memory corruption issue, tracked by PHP as GHSA-w8hw-w9fx-j79w. PHP rates it CVSS v4.0 9.2. The vector published with the advisory is AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The weakness list includes use after free (CWE-416).
PHP uses longjmp() when a request hits an out-of-memory condition. In some contexts, request memory is only partly initialized. If an allocation fails then, PHP can leave that memory invalid. Later request shutdown may read or branch on it. The failed allocation does not have to be the one that left the memory invalid. The advisory says multiple out-of-memory strategies can reach remote code execution.
What was demonstrated
PHP says complete remote code execution was validated over HTTP against Apache mod_php with default input and memory limits, on normal prefork configurations with multiple workers. The condition can be reached before application code runs, because mod_php still runs request shutdown when request startup fails.
PHP-FPM exits the child when request startup fails, which avoids consuming that particular invalid state. After a normal startup, an out-of-memory event can still reach the same class of bug during shutdown. PHP’s source analysis calls FPM susceptible. The advisory says no complete FPM exploit was demonstrated for this CVE.
FrankenPHP is described as likely susceptible to application-independent attacks because, like mod_php, it calls request shutdown unconditionally. LSAPI is described as modeled on FPM, with application-specific exploitation considered likely and unvalidated.
The code change
The patch stops using longjmp() for this out-of-memory path. PHP describes a delayed soft out-of-memory at the next VM safe point, and a hard exit if memory reaches a second, higher threshold. Shutdown then does not see the invalid state.
Partial configuration measures
If you cannot update yet, PHP’s primary configuration measure for this CVE is an administratively enforced memory_limit=-1, with a check that no pool, directory, or application setting restores a finite limit. Restart every worker afterward. PHP also says to keep post_max_size conservative, to enforce decoded request size at the frontend, and to avoid RLIMIT_AS and RLIMIT_DATA because those can force the vulnerable allocation failure.
A container memory limit is an availability boundary, not a complete fix. None of these settings replace 8.2.35, 8.3.36, 8.4.27, 8.5.12, or a vendor build that contains the same patch.
Questions
Does memory_limit=-1 fix CVE-2026-109618?
PHP says it removes the controllable per-request limit used by the confirmed exploit and is not a complete fix. An underlying allocation failure can still reach the vulnerable path.