BIT-libphp-2026-109618: RCE via OOM corruption

Q: What access does an attacker need to exploit this issue?

The vector is network-accessible and requires no privileges or user interaction. Exploitation has high attack complexity and requires the attacker to trigger an applicable out-of-memory condition.

Q: Which deployments are affected?

The listed affected software is bitnami/libphp, bitnami/php, and bitnami/php-min. The available data does not identify affected versions or configuration-specific prerequisites.

Q: What is the likely impact if exploitation succeeds?

Successful exploitation can lead to remote code execution. The severity vector indicates high impact to confidentiality, integrity, and availability of the vulnerable component.

Q: Can this be detected from the supplied information?

No specific indicators of compromise, log entries, or detection methods are provided. The issue involves request handling after an out-of-memory error, so investigation would need additional vendor or upstream guidance.

Published Oct 22, 2026

Updated

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Affected Software

12 affected componentsFixes available

bitnami/libphp>=7.3.0<8.2.35

8.2.35

bitnami/libphp>=8.3.0<8.3.36

8.3.36

bitnami/libphp>=8.4.0<8.4.27

8.4.27

bitnami/libphp>=8.5.0<8.5.12

8.5.12

bitnami/php>=7.3.0<8.2.35

8.2.35

bitnami/php>=8.3.0<8.3.36

8.3.36

bitnami/php>=8.4.0<8.4.27

8.4.27

bitnami/php>=8.5.0<8.5.12

8.5.12

bitnami/php-min>=7.3.0<8.2.35

8.2.35

bitnami/php-min>=8.3.0<8.3.36

8.3.36

bitnami/php-min>=8.4.0<8.4.27

8.4.27

bitnami/php-min>=8.5.0<8.5.12

8.5.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/libphp to a version that resolves this vulnerability.
Fixed in 8.2.35
Upgrade
Upgrade bitnami/libphp to a version that resolves this vulnerability.
Fixed in 8.3.36
Upgrade
Upgrade bitnami/libphp to a version that resolves this vulnerability.
Fixed in 8.4.27
Upgrade
Upgrade bitnami/libphp to a version that resolves this vulnerability.
Fixed in 8.5.12
Upgrade
Upgrade bitnami/php to a version that resolves this vulnerability.
Fixed in 8.2.35
Upgrade
Upgrade bitnami/php to a version that resolves this vulnerability.
Fixed in 8.3.36
Upgrade
Upgrade bitnami/php to a version that resolves this vulnerability.
Fixed in 8.4.27
Upgrade
Upgrade bitnami/php to a version that resolves this vulnerability.
Fixed in 8.5.12
Upgrade
Upgrade bitnami/php-min to a version that resolves this vulnerability.
Fixed in 8.2.35
Upgrade
Upgrade bitnami/php-min to a version that resolves this vulnerability.
Fixed in 8.3.36
Upgrade
Upgrade bitnami/php-min to a version that resolves this vulnerability.
Fixed in 8.4.27
Upgrade
Upgrade bitnami/php-min to a version that resolves this vulnerability.
Fixed in 8.5.12

Event History

Oct 22, 2026

Advisory Published

via OSV·08:04 AM

Data Sourced

via OSV·08:04 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vector is network-accessible and requires no privileges or user interaction. Exploitation has high attack complexity and requires the attacker to trigger an applicable out-of-memory condition.

Which deployments are affected?

The listed affected software is bitnami/libphp, bitnami/php, and bitnami/php-min. The available data does not identify affected versions or configuration-specific prerequisites.

What is the likely impact if exploitation succeeds?

Successful exploitation can lead to remote code execution. The severity vector indicates high impact to confidentiality, integrity, and availability of the vulnerable component.

Can this be detected from the supplied information?

No specific indicators of compromise, log entries, or detection methods are provided. The issue involves request handling after an out-of-memory error, so investigation would need additional vendor or upstream guidance.

BIT-libphp-2026-109618: RCE via OOM corruption

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are affected?

What is the likely impact if exploitation succeeds?

Can this be detected from the supplied information?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are affected?

What is the likely impact if exploitation succeeds?

Can this be detected from the supplied information?