PHP’s Memory Bugs, Explained

Two memory bugs, the fixes, and what developers should update.

PHP normally handles request memory for the application developer. It sets up a request, runs the application, and releases temporary resources when that request ends.

The two vulnerabilities described in PHP's 21 October security advisory break different parts of that lifecycle. One lets cleanup use partly prepared data. The other lets a worker retain a reference to memory after its request has finished.

Understanding the difference makes the fixes easier to follow. The diagrams below explain both bugs, followed by the patched versions and PHP's separate 23 October follow-up.

Technical details and update guidance were checked against the linked PHP advisories on 25 October 2026.

PHP: cleanup used unfinished data

CVE-2026-109618

When PHP prepares a web request, it creates internal data structures. Some can temporarily be visible to other code before every field is ready.

If a memory allocation failed at that moment, PHP could use longjmp() to leave the current operation abruptly. Think of it as jumping straight to an error-recovery point while leaving the intervening work unfinished.