The advisory lists three multipart-parsing ways for a request to reach out-of-memory while staying within its apparent PHP limits, the first being: "A multipart request without a usable declared content length may pass the initial `post_max_size` check and continue supplying decoded body data."

The exact words it rests on

Several multipart parsing problems can let a request reach OOM while remaining within its apparent PHP limits: - A multipart request without a usable declared content length may pass the initial `post_max_size` check and continue supplying decoded body data.

What the source said when we opened it, on 23 Oct 2026.

The source

GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618)
PHP project (php-src security advisories) · 2026-10-21

Open the sourcearchived copy

Checked

Checked by the notis newsroom on 23 Oct 2026, against the source above.

In the story

PHP patches two critical remote code execution flaws 23 Oct 2026