ID:13130 - Exploit for Use-after-free in PHP - CVE-2026-109618

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code as the web worker account.

The vulnerability exists due to improper handling of out-of-memory exceptions in PHP's request lifecycle when allocation failures trigger longjmp() while incompletely initialized request memory is reachable. A remote attacker can send specially crafted HTTP requests that exhaust memory, including multipart requests, to leave invalid memory state that is subsequently processed during request shutdown, leading to arbitrary code execution.

FPM susceptibility is supported by source analysis, but no complete FPM exploit has been demonstrated.

Remediation