Memory corruption vulnerabilities in PHP

{
  "id": "9dadb9e2fb933d05f605ee37e9980619ddeb5b79f23655eb86f0ce33612db6f3",
  "url": "https://kb.cert.org/vuls/id/763488",
  "method": "llm",
  "payload": {
    "kind": "advisory",
    "title": "Memory corruption vulnerabilities in PHP",
    "summary": "Two PHP memory-safety vulnerabilities may allow unauthenticated remote attackers to execute arbitrary code through specially crafted HTTP requests. Users are advised to update to patched PHP versions.",
    "evidence": "Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
    "products": [
      {
        "name": {
          "value": "PHP",
          "evidence": "Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12."
        },
        "prerequisites": [
          {
            "value": "An unauthenticated remote attacker with network access to PHP web services",
            "evidence": "An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potentially achieve arbitrary code execution."
          }
        ],
        "fixed_versions": [
          {
            "value": "8.2.35",
            "evidence": "All PHP users are strongly encouraged to update immediately to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12."
          },
          {
            "value": "8.3.36",
            "evidence": "All PHP users are strongly encouraged to update immediately to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12."
          },
          {
            "value": "8.4.27",
            "evidence": "All PHP users are strongly encouraged to update immediately to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12."
          },
          {
            "value": "8.5.12",
            "evidence": "All PHP users are strongly encouraged to update immediately to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12."
          }
        ],
        "affected_versions": [
          {
            "value": "prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12",
            "evidence": "Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12."
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-109618",
        "evidence": "CVE-2026-109618: A memory corruption vulnerability exists in the out-of-memory (OOM) handling mechanism of PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12."
      },
      {
        "value": "CVE-2026-109619",
        "evidence": "CVE-2026-109619: A use-after-free vulnerability exists in the global state management of PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-cert-cc-vulnerability-notes",
  "document_id": 23360,
  "published_at": "2026-10-22T22:23:51.159+00:00"
}