vulnerabilities handled in PHP

PHP has two critical vulnerabilities. These vulnerabilities can be exploited without authentication to execute arbitrary code. All PHP installations that process web requests are affected. The vulnerability with the identifier CVE-2026-109618 involves memory corruption during the handling of an...

fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01)

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response...

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web...

Exploit for CVE-2026-109618

Emergency Mitigation Measures for PHP CVE-2026-109618 / CV...

USN-8948-1 php8.1, php8.3, php8.5 vulnerabilities

It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. CVE-2026-109618 It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could u...

USN-8948-1: PHP vulnerabilities

It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. CVE-2026-109618 It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could u...

CVE-2026-109619 RCE via stale global state

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...

CVE-2026-109619

The PHP engine is vulnerable to a Use-After-Free (UAF) condition where global state may incorrectly persist or be repopulated after being freed, allowing subsequent requests to read or branch on stale memory. This flaw occurs because certain strategies can trigger a scenario where global state re...

CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...

CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...

EUVD-2026-107265

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...

CVE-2026-109619 RCE via stale global state

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on...

Exploit for CVE-2026-109618

php2shell — CVE-2026-109618 / CVE-2026-109619 Pre-authenticat...

CVE-2026-109618

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

EUVD-2026-107260

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

CVE-2026-109618

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment

A family of runtime memory safety vulnerabilities, with impacts ranging from worker crashes and data disclosure to pre-authentication remote code execution. Introduction Researchers from Wiz, OpenAI, and Calif jointly disclosed PHP2Shell CVE-2026-109618 and CVE-2026-109619, a set of memory safety...

fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01)

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response...

Dulwich: Symlink Directory Traversal In Stash Pop Allows Arbitrary File Write Via Intermediate Directory Symlinks

Summary Dulwich's "stash.py:pop" function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. Root Cause The "pop" function at "dulwich/stash.py:236" uses...

CVE-2026-94300

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially...