RCE via OOM corruption

out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current ...

Уязвимость функции longjmp() компонента session.upload_progress ядра интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код

Security update for php8

Security update for php74

Security update for php8

Security update for php8

Security update for php8

Уязвимость компонента session.upload_progress ядра интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код

Important: php security update

Important: php:8.3 security update

Important: php:8.2 security update

Important: php:8.2 security update

Important: php8.4 security update

Important: php security update

ELSA-2026-87151: php security update (IMPORTANT)

ELSA-2026-87079: php:8.3 security update (IMPORTANT)