CVE-2026–109618 — php got cooked?

for this CVE we dont need to know php deeply, we only need to know how php manages its memory internal

what does php do?

imagine we've built a website which greets users(classic example)

<?php
$name = $_GET["name"] ?? "Guest";

echo "Hello, " . $name;
?>

<?php
$name = $_GET["name"] ?? "Guest";

echo "Hello, " . $name;
?>

example.com/?name=fahisxd

would give "Hello, fahisxd"

this code is not executed by host browser but server

now php is mainly made of C(implemented in C) bcz it gives direct control over memory

php's core component responsible for executing programs is Zend Engine

direct control over memory means also allocating and freeing it

allocating memory means storing perticular value to a parameter in RAM, after the instance is finished its freed

now we get into an edge case

WHAT HAPPENS WHEN IT RUNS OUT OF MEMORY?

php can be/is configured with memory limit

this helps php from taking all memory and crashing server

now let's say php has only 1m of space from 128m of limit cap, but allocator is demanding >1m of space: now it must stop operation safely

normally we want : Memory allocation fails => PHP detects failure => PHP handles the error => PHP cleans up safely => Request terminates

this CVE revolves concerns when PHP interrupts processing before its internal data structures are inititialized

this bug leaves something half finished

now lets say

[step 1]:> allocated a feild as name,
[step 2]:> tries to initialize it(given its value) as 0day, but now
when it initialize, it doesn’t have enough space to store ‘0day’ value
[step 3]x> escaped through zend_bailout()

[step 1]:> allocated a feild as name,
[step 2]:> tries to initialize it(given its value) as 0day, but now
when it initialize, it doesn’t have enough space to store ‘0day’ value
[step 3]x> escaped through zend_bailout()

which leaves it accessible to other internal code

now the critic is an old error handler 'zend_bailout()' performs an emergency escape the current operation leaving it uncleeaned, instead of undo-ing stuff

but the unfinished stuff can still be accessible

later clean up processes may assume it as initialized

but im still grinding on how it leads to a probable RCE

as a final note update your php

fixed releases are : 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released on Oct 21, 8.1 and older have no fix