Inside CVE-2026-109618: how PHP's out-of-memory path became a remote code execution bug

Dev.to•Fri, Oct 23, 2026, 02:40 PM•2 min read

Inside CVE-2026-109618: how PHP's out-of-memory path became a remote code execution bug PHP's memory limit is meant to protect a server from a runaway script. On 21 October 2026 the PHP project shipped fixes for a flaw that turns that safety mechanism into an attack primitive. CVE-2026-109618 i...

Source: [Dev.to](https://dev.to/bianliang/inside-cve-2026-109618-how-phps-out-of-memory-path-became-a-remote-code-execution-bug-1d0b)

📰 Read Full Story

This is an aggregated headline summary. For the complete report, visit the original publisher.

Continue Reading at Dev.to ↗

#tech #php #memory #request #code #advisory #limit #path #execution

More Headlines

Technology9to5Mac• 8m ago

Apple’s website has fun new easter egg: a fully interactive iPod

Today is the 25th anniversary of Apple unveiling the first iPod. And as discovered by Kian on X , the company’s website now has a fun new iPod easter egg.

TechnologyHacker News• 8m ago

Trailing SOTA Is a Feature for Profit Maximisation Under Compute Constraints

1 points, 0 comments on Hacker News

SciencePhys.org• 8m ago

NASA's Hubble charts path for Roman with gravitational lenses

A sweeping barred spiral galaxy marks the spot in this image, but the real treasure is the gravitational lens in the lower-right corner, where a distant background galaxy is being magnified and distorted by the gravity of a closer galaxy.

TechnologyHacker News• 9m ago

Postgres 19 is late, and it's AI's fault

1 points, 0 comments on Hacker News

TechnologyBusiness Insider• 10m ago

I swapped houses with a stranger to see if I'd like living in Seattle. One month in, I got my answer.

I used a home exchange website to live in Seattle for a month and decide if i wanted to move there from San Francisco. It gave me the clarity I needed.

TechnologyHacker News• 10m ago

Tell HN: Unbounce Security Incident

Got this email a bit ago: We detected a security event that began on or about October 14, 2026 that may have resulted in the exposure of keys for Unbounce’s integration with third party applications. You are receiving this notice because your former Unbounce account was connected to one or more ...