PHP Memory Corruption Vulnerability

A critical out-of-memory corruption vulnerability has been identified in PHP, tracked as CVE-2026-109618. The vulnerability allows unauthenticated remote code execution, posing a severe risk to affected systems. CISA has issued an alert requiring immediate patching of affected PHP installations. The vulnerability affects an open-source component that may be used across a wide range of products and implementations. CISA's Binding Operational Directive BOD 26-04 mandates prioritization of security updates based on risk. Forensic triage requirements have also been outlined in the BOD 26-04 implementation guidance. Organizations using PHP are urged to apply patches immediately to mitigate potential exploitation. The vulnerability is documented in the NVD and additional details are available via the PHP project and CISA advisory pages.