Low Severity
CVE-2026-109618
Published: Oct 25, 2026
Safely verify the October 2026 PHP OOM security fixes by testing patched runtime behaviour
# PHP security fix behaviour check
A small behavioural check for the PHP security fixes released on 21st October 2026:
- [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w): RCE via OOM corruption
- [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp): RCE via stale global state
It does not use an exploit payload or send HTTP requests. It runs a short-lived PHP CLI process with an 8 MiB memory limit and checks how PHP terminates when the limit is reached.
## Usage
```bash
./check-php-security-fixes.sh
```
Pass a path when the binary is not named `php`:
```bash
./check-php-security-fixes.sh /usr/bin/php8.1
```
Run it inside every PHP container or image you deploy. A check on the host does not inspect PHP inside containers.
```bash
docker exec -i CONTAINER bash -s < check-php-security-fixes.sh
```
The script exits with:
| Code | Meaning |
|---:|---|
| `0` | Patched behaviour observed |
| `1` | Old, unpatched bailout behaviour observed |
| `2` | The result was inconclusive or PHP was not found |
## What it checks
Unpatched PHP runs registered shutdown functions after the tested out-of-memory condition. The security patch changes that behaviour so PHP terminates before shutdown processing can touch incomplete or stale request state.
Current supported PHP releases use a new hard memory limit and exit with status 137. PHP's official 7.4, 8.0 and 8.1 source backports use an immediate safe exit with status 1. The script recognises both implementations.
The complete upstream change covers both CVEs. The stale-global-state issue cannot be independently distinguished on an arbitrary production binary without deliberately shaping the heap, which this checker does not attempt.
## Safety
The check:
- runs only against a local PHP CLI binary;
- uses roughly 10 MiB of memory;
- loads no `php.ini` or extensions because it invokes PHP with `-n`;
- performs no network access;
- creates no file