CVE-2026-109618
Publication date 21 October 2026
Last updated 21 October 2026
Ubuntu priority
Description
out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
Read the notes from the security team
Why is this CVE critical priority?
This is a remote code execution vulnerability
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| php5 | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 14.04 LTS trusty |
Fixed in 5.5.9+dfsg-1ubuntu4.29+esm18
|
|
| php7.0 | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 16.04 LTS xenial |
Fixed in 7.0.33-0ubuntu0.16.04.16+esm22
|
|
| php7.2 | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 18.04 LTS bionic |
Fixed in 7.2.24-0ubuntu0.18.04.17+esm14
|
|
| php7.4 | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Fixed in 7.4.3-4ubuntu2.29+esm5
|
|
| php8.1 | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy |
Fixed in 8.1.2-1ubuntu2.28
|
|
| php8.3 | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble |
Fixed in 8.3.6-0ubuntu0.24.04.13
|
|
| 22.04 LTS jammy | Not in release | |
| php8.5 | 26.10 stonking |
Fixed in 8.5.9-0ubuntu2.1
|
| 26.04 LTS resolute |
Fixed in 8.5.4-0ubuntu1.5
|
|
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
References
Related Ubuntu Security Notices (USN)
- USN-8948-1
- PHP vulnerabilities
- 21 October 2026
- USN-8948-2
- PHP vulnerabilities
- 21 October 2026