Patching CVE-2026-109618 across a fleet: where PHP actually hides in your inventory

The advisory for CVE-2026-109618 names four fixed versions and leaves the hard part to the reader. Working out which of your systems run an affected interpreter is a discovery problem, because PHP is usually present as a dependency rather than as a product anyone tracks.

Overview

CVE-2026-109618 is a critical PHP core vulnerability rated 9.2 under CVSS v4.0, fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It allows remote code execution without authentication. CVE-2026-109619 was fixed by the same release and carries the same rating.

How the defect works

PHP enforces the per-request memory_limit through longjmp() . When an allocation would exceed the configured ceiling, the engine jumps back to a recovery point instead of returning an error through the normal path.

The Cypriot CSIRT advisory explains why that matters.…