{
  "updated_at": "2026-10-23T00:52:34.437Z",
  "debian": {
    "12": {
      "codename": "bookworm",
      "packages": {
        "php8.2": {
          "fixed": {
            "CVE-2026-109618": "8.2.35-1~deb12u1",
            "CVE-2026-109619": "8.2.35-1~deb12u1"
          },
          "pro": false
        }
      }
    },
    "13": {
      "codename": "trixie",
      "packages": {
        "php8.4": {
          "fixed": {
            "CVE-2026-109618": "8.4.27-1~deb13u1",
            "CVE-2026-109619": "8.4.27-1~deb13u1"
          },
          "pro": false
        }
      }
    },
    "14": {
      "codename": "forky",
      "packages": {
        "php8.4": {
          "fixed": {
            "CVE-2026-109618": null,
            "CVE-2026-109619": null
          },
          "pro": false
        }
      }
    }
  },
  "redhat": {
    "6": {
      "advisories": [],
      "states": [
        {
          "cve": "CVE-2026-109618",
          "package": "php",
          "state": "Under investigation"
        },
        {
          "cve": "CVE-2026-109619",
          "package": "php",
          "state": "Not affected"
        }
      ]
    },
    "7": {
      "advisories": [],
      "states": [
        {
          "cve": "CVE-2026-109618",
          "package": "php",
          "state": "Under investigation"
        },
        {
          "cve": "CVE-2026-109619",
          "package": "php",
          "state": "Not affected"
        }
      ]
    },
    "8": {
      "advisories": [
        {
          "advisory": "RHSA-2026:87073",
          "cve": "CVE-2026-109618",
          "package": "php:8.2-8100020261020140951.f7998665"
        },
        {
          "advisory": "RHSA-2026:87080",
          "cve": "CVE-2026-109618",
          "package": "php:7.4-8100020261021081045.f7998665"
        },
        {
          "advisory": "RHSA-2026:87073",
          "cve": "CVE-2026-109619",
          "package": "php:8.2-8100020261020140951.f7998665"
        },
        {
          "advisory": "RHSA-2026:87080",
          "cve": "CVE-2026-109619",
          "package": "php:7.4-8100020261021081045.f7998665"
        }
      ],
      "states": []
    },
    "9": {
      "advisories": [
        {
          "advisory": "RHSA-2026:87072",
          "cve": "CVE-2026-109618",
          "package": "php:8.2-9080020261020145734.9"
        },
        {
          "advisory": "RHSA-2026:87079",
          "cve": "CVE-2026-109618",
          "package": "php:8.3-9080020261020115403.9"
        },
        {
          "advisory": "RHSA-2026:87151",
          "cve": "CVE-2026-109618",
          "package": "php-0:8.0.30-8.el9_8.1"
        },
        {
          "advisory": "RHSA-2026:87072",
          "cve": "CVE-2026-109619",
          "package": "php:8.2-9080020261020145734.9"
        },
        {
          "advisory": "RHSA-2026:87079",
          "cve": "CVE-2026-109619",
          "package": "php:8.3-9080020261020115403.9"
        },
        {
          "advisory": "RHSA-2026:87151",
          "cve": "CVE-2026-109619",
          "package": "php-0:8.0.30-8.el9_8.1"
        }
      ],
      "states": [
        {
          "cve": "CVE-2026-109618",
          "package": "php:8.4/php",
          "state": "Affected"
        },
        {
          "cve": "CVE-2026-109619",
          "package": "php:8.4/php",
          "state": "Affected"
        }
      ]
    },
    "10": {
      "advisories": [
        {
          "advisory": "RHSA-2026:87070",
          "cve": "CVE-2026-109618",
          "package": "php-0:8.3.36-1.el10_2"
        },
        {
          "advisory": "RHSA-2026:87071",
          "cve": "CVE-2026-109618",
          "package": "php8.4-0:8.4.27-1.el10_2"
        },
        {
          "advisory": "RHSA-2026:87070",
          "cve": "CVE-2026-109619",
          "package": "php-0:8.3.36-1.el10_2"
        },
        {
          "advisory": "RHSA-2026:87071",
          "cve": "CVE-2026-109619",
          "package": "php8.4-0:8.4.27-1.el10_2"
        }
      ],
      "states": []
    }
  },
  "redhat_notes": {
    "CVE-2026-109618": {
      "cvss3": "8.1",
      "severity": "Important",
      "statement": "Rated Important. An unauthenticated remote attacker could corrupt engine memory and potentially execute arbitrary code, but reliable exploitation requires precise heap manipulation and timing. Standard Red Hat Enterprise Linux deployments use PHP-FPM rather than mod_php. PHP-FPM workers exit on early initialization failures before reaching the corrupted structures, so remote code execution is difficult in practice and typically requires non-default behavior such as parsing a second request body during script execution."
    },
    "CVE-2026-109619": {
      "cvss3": "8.1",
      "severity": "Important",
      "statement": "An unauthenticated remote attacker can trigger memory corruption leading to potential arbitrary code execution. In typical Red Hat Enterprise Linux deployments, PHP applications exposed to public networks handle incoming requests directly, so no prior authentication is needed to reach the vulnerable code. Exploitation requires hitting a precise out-of-memory condition during request processing, which keeps this below Critical."
    }
  },
  "schema": 1,
  "ubuntu": {
    "14.04": {
      "codename": "trusty",
      "packages": {
        "php5": {
          "fixed": {
            "CVE-2026-109618": "5.5.9+dfsg-1ubuntu4.29+esm18",
            "CVE-2026-109619": "5.5.9+dfsg-1ubuntu4.29+esm18"
          },
          "pro": true
        }
      }
    },
    "16.04": {
      "codename": "xenial",
      "packages": {
        "php7.0": {
          "fixed": {
            "CVE-2026-109618": "7.0.33-0ubuntu0.16.04.16+esm22",
            "CVE-2026-109619": "7.0.33-0ubuntu0.16.04.16+esm22"
          },
          "pro": true
        }
      }
    },
    "18.04": {
      "codename": "bionic",
      "packages": {
        "php7.2": {
          "fixed": {
            "CVE-2026-109618": "7.2.24-0ubuntu0.18.04.17+esm14",
            "CVE-2026-109619": "7.2.24-0ubuntu0.18.04.17+esm14"
          },
          "pro": true
        }
      }
    },
    "20.04": {
      "codename": "focal",
      "packages": {
        "php7.4": {
          "fixed": {
            "CVE-2026-109618": "7.4.3-4ubuntu2.29+esm5",
            "CVE-2026-109619": "7.4.3-4ubuntu2.29+esm5"
          },
          "pro": true
        }
      }
    },
    "22.04": {
      "codename": "jammy",
      "packages": {
        "php8.1": {
          "fixed": {
            "CVE-2026-109618": "8.1.2-1ubuntu2.28",
            "CVE-2026-109619": "8.1.2-1ubuntu2.28"
          },
          "pro": false
        }
      }
    },
    "24.04": {
      "codename": "noble",
      "packages": {
        "php8.3": {
          "fixed": {
            "CVE-2026-109618": "8.3.6-0ubuntu0.24.04.13",
            "CVE-2026-109619": "8.3.6-0ubuntu0.24.04.13"
          },
          "pro": false
        }
      }
    },
    "26.04": {
      "codename": "resolute",
      "packages": {
        "php8.5": {
          "fixed": {
            "CVE-2026-109618": "8.5.4-0ubuntu1.5",
            "CVE-2026-109619": "8.5.4-0ubuntu1.5"
          },
          "pro": false
        }
      }
    },
    "26.10": {
      "codename": "stonking",
      "packages": {
        "php8.5": {
          "fixed": {
            "CVE-2026-109618": "8.5.9-0ubuntu2.1",
            "CVE-2026-109619": "8.5.9-0ubuntu2.1"
          },
          "pro": false
        }
      }
    }
  }
}