PHP Memory Corruption Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 26/10/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| php | ≥ 7.3.0, < 8.2.35≥ 8.3.0, < 8.3.36≥ 8.4.0, < 8.4.27≥ 8.5.0, < 8.5.12 | 8.2.358.3.368.4.278.5.12 |
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free