Overview Recently, NSFOCUS CERT monitored the public disclosure of PHP Remote Code Execution (RCE) vulnerabilities (CVE-2026-109618 / CVE-2026-109619). Due to memory management flaws in PHP Core—where longjmp() handles Out-Of-Memory (OOM) errors leading to failed memory allocations, as well as various global state handling operations—a Use-After-Free (UAF) condition can occur. Unauthenticated...
