Out-of-memory corruption
CVE-2026-109618 concerns PHP’s early exit during an out-of-memory condition. Partly initialized request memory can remain reachable and later be consumed during cleanup. The patch replaces the unsafe OOM exit pattern with soft and hard memory handling. Complete unauthenticated RCE was validated against mod_php. The official advisory considers FPM susceptible to application-specific paths, but does not claim a complete FPM exploit for this CVE.
Is PHP-FPM exempt?
No. Exploitability differs by SAPI and by vulnerability. FPM terminates a child when request startup fails, preventing some demonstrated startup-only sequences. It does not eliminate application-level or cross-request state paths. Do not generalize the mod_php demonstration into identical exploitability everywhere, or use FPM as evidence that patching is unnecessary.
Memory settings require care
PHP recommends administratively enforcing memory_limit=-1 only as an incomplete temporary measure against controllable PHP-limit OOM. Underlying allocation failure can still reach the vulnerable path. Independent container or cgroup containment is needed to manage availability risk. Do not substitute RLIMIT_AS or RLIMIT_DATA. Keep decoded request size, multipart headers, nesting and part counts bounded; a low post_max_size alone is not complete protection.
2. Install a patched build
The first fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Choose your existing supported branch or a compatible newer supported branch. Update all matching extensions with the runtime. Test application compatibility and health checks. Fetch releases or packages from PHP or the responsible vendor; an unchanged CMS or a WAF rule is not a runtime patch.
| PHP branch | Upstream releases below | First patched release | Security support ends |
|---|---|---|---|
| PHP 8.5 | < 8.5.12 | ✓ 8.5.12 | Dec 31, 2029 |
| PHP 8.4 | < 8.4.27 | ✓ 8.4.27 | Dec 31, 2028 |
| PHP 8.3 | < 8.3.36 | ✓ 8.3.36 | Dec 31, 2027 |
| PHP 8.2 | < 8.2.35 | ✓ 8.2.35 | Dec 31, 2026 |
No normal PHP project release is available for these branches. Minimal source backports exist for 7.4, 8.0 and 8.1; vendor support must be verified separately. Read guide ↗