An out-of-memory (OOM) handling errors leading to memory corruption and use-after-free (UAF) conditions exists in PHP. Its exploitation, with an unauthenticated specially crafted request, can lead to Remote Code Execution (RCE). This affects confidentiality, integrity, and availability.
Affected PHP versions are :
- up to version 8.2.34 (included)
- 8.3 up to version 8.3.35 (included)
- 8.4 up to version 8.4.26 (included)
- 8.5 up to version 8.5.11 (included)
Stormhield Network Security (SNS) appliance protects you from a major attack path that exploits these vulnerabilities, thanks to a dedicated IPS Signature. To work efficiently, the SSL traffic needs to be decrypted.
| ID | Name |
| http:mix.374 | Detection of an unauthenticated vulnerability exploitation in PHP (CVE-2026-109618, CVE-2026-109619) |