BIT-php-2026-109618: RCE via OOM corruption

Q: What does an attacker need to exploit this issue?

The issue is remotely exploitable without privileges or user interaction, but exploitation requires high attack complexity and an additional prerequisite condition. The attacker must be able to trigger an out-of-memory condition using one of the OOM strategies that reaches the affected request-cleanup path.

Q: What is the likely impact if exploitation succeeds?

Successful exploitation can lead to remote code execution. The supplied severity vector indicates high impact to confidentiality, integrity, and availability of the vulnerable component.

Q: How can I tell whether my deployment is exposed?

Review whether you run bitnami/libphp, bitnami/php, or bitnami/php-min. Exposure depends on whether an unauthenticated remote party can cause PHP requests to exhaust memory and trigger the affected OOM handling and cleanup behavior.

Published Oct 22, 2026

Updated

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Affected Software

12 affected componentsFixes available

bitnami/libphp>=7.3.0<8.2.35

8.2.35

bitnami/libphp>=8.3.0<8.3.36

8.3.36

bitnami/libphp>=8.4.0<8.4.27

8.4.27

bitnami/libphp>=8.5.0<8.5.12

8.5.12

bitnami/php>=7.3.0<8.2.35

8.2.35

bitnami/php>=8.3.0<8.3.36

8.3.36

bitnami/php>=8.4.0<8.4.27

8.4.27

bitnami/php>=8.5.0<8.5.12

8.5.12

bitnami/php-min>=7.3.0<8.2.35

8.2.35

bitnami/php-min>=8.3.0<8.3.36

8.3.36

bitnami/php-min>=8.4.0<8.4.27

8.4.27

bitnami/php-min>=8.5.0<8.5.12

8.5.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/libphp to a version that resolves this vulnerability.
Fixed in 8.2.35
Upgrade
Upgrade bitnami/libphp to a version that resolves this vulnerability.
Fixed in 8.3.36
Upgrade
Upgrade bitnami/libphp to a version that resolves this vulnerability.
Fixed in 8.4.27
Upgrade
Upgrade bitnami/libphp to a version that resolves this vulnerability.
Fixed in 8.5.12
Upgrade
Upgrade bitnami/php to a version that resolves this vulnerability.
Fixed in 8.2.35
Upgrade
Upgrade bitnami/php to a version that resolves this vulnerability.
Fixed in 8.3.36
Upgrade
Upgrade bitnami/php to a version that resolves this vulnerability.
Fixed in 8.4.27
Upgrade
Upgrade bitnami/php to a version that resolves this vulnerability.
Fixed in 8.5.12
Upgrade
Upgrade bitnami/php-min to a version that resolves this vulnerability.
Fixed in 8.2.35
Upgrade
Upgrade bitnami/php-min to a version that resolves this vulnerability.
Fixed in 8.3.36
Upgrade
Upgrade bitnami/php-min to a version that resolves this vulnerability.
Fixed in 8.4.27
Upgrade
Upgrade bitnami/php-min to a version that resolves this vulnerability.
Fixed in 8.5.12

Event History

Oct 22, 2026

Advisory Published

via OSV·08:04 AM

Data Sourced

via OSV·08:04 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

The issue is remotely exploitable without privileges or user interaction, but exploitation requires high attack complexity and an additional prerequisite condition. The attacker must be able to trigger an out-of-memory condition using one of the OOM strategies that reaches the affected request-cleanup path.

What is the likely impact if exploitation succeeds?

Successful exploitation can lead to remote code execution. The supplied severity vector indicates high impact to confidentiality, integrity, and availability of the vulnerable component.

How can I tell whether my deployment is exposed?

Review whether you run bitnami/libphp, bitnami/php, or bitnami/php-min. Exposure depends on whether an unauthenticated remote party can cause PHP requests to exhaust memory and trigger the affected OOM handling and cleanup behavior.

BIT-php-2026-109618: RCE via OOM corruption

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

How can I tell whether my deployment is exposed?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

How can I tell whether my deployment is exposed?