CVE-2026-109618GHSA-w8hw-w9fx-j79w
PHP: RCE via OOM corruption
PHP Group PHPRuntimes & languagesCVSS
9.2CriticalExploitationExploitation reported25 outlets report it, first 20 Oct 2026. Not yet in the KEV catalogReports
Exploit odds (EPSS)11.6%Chance of exploitation activity in the next 30 days, higher than 96% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 8.2.35PHPCVE List
- 8.3.36PHPCVE List
- 8.4.27PHPCVE List
- 8.5.12PHPCVE List
- 8.2.35php-src, phpGitHub
- 8.3.36php-src, phpGitHub
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
- 21 Oct 2026, 01:54 UTCFirst reported exploitedAikido
- 21 Oct 2026, 07:29 UTCExploit code publicGitHub proof-of-concept repositories
- 21 Oct 2026, 13:48 UTCPublishedCVE List
- 22 Oct 2026, 00:00 UTCWAF rule availableCloudflare WAF
- NowNot on CISA's known exploited list yet
Protection while you patch 1
WAF and edge providers that shipped rules for this CVE. A rule can block known attack patterns; it does not fix the software, so still upgrade.
Vendor and government advisories 10
Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.
- CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)Palo Alto Networks, 23 Oct 2026Vendor
- Vulnerabilities in PHP Affecting Cisco Products: October 2026Cisco PSIRT, 23 Oct 2026Vendor
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)SANS Internet Storm Center, 21 Oct 2026Government
- USN-8948-2: PHP vulnerabilitiesUbuntu security notices, 21 Oct 2026Vendor
- Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619Google Cloud security, 21 Oct 2026Vendor
- Critical Vulnerabilities in PHP Require Immediate PatchingCISA advisories, 21 Oct 2026Government
- Critical security issue affecting PHPNCSC UK, 21 Oct 2026Government
- PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)Fortinet PSIRT, 21 Oct 2026Vendor
- Security advisory: Critical remote code execution vulnerabilities, update nowPHP, 21 Oct 2026Vendor
- [Màj] Multiples vulnérabilités dans PHP (21 octobre 2026)CERT-FR alerts, 21 Oct 2026Government
Public exploit code and templates 2
- Remote exploitPHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE 22 Oct 2026Exploit-DB
- Scanner templatePHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash DetectionNuclei
Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.
Reports 101
25 outlets report exploitation. Reports are not confirmation; each links to its source.
- @bookness.bsky.social: 【カーリル】PHPの重大な脆弱性（CVE-2026-109618／CVE-2026-109619）によるカーリルへの影響について blog.calil.jp/2026/10/php.... >カーリルが提供する各サービス（カーリル、Unitrad API、カーリル for AI、学校図書館支援プログラムなど）は、PHPを使用していません。そのため、本脆弱性にBluesky: CVE posts, 24 Oct 2026
- akamor2800/php-5.4-cve-2026-php2shell-patch: Production-ready backported .patch for EOL PHP 5.4,.23 custom 5.x to fix the critical PHP2Shell (OOM) vulnerability (CVE-2026-109618 / CVE-2026-109619).GitHub proof-of-concept repositories, 24 Oct 2026Exploit code
- devzyai/CVE-2026-109618-POC: A PHP app that ships an unpatched PHP runtime (PHP2Shell), for the Devzy scan to flag. No exploit code.GitHub proof-of-concept repositories, 24 Oct 2026Exploit code
- @indirlab.com: PHP dilindeki kritik PHP2Shell açıkları interneti nasıl felaketin eşiğine getirdi? CVE-2026-109618 ve CVE-2026-109619 açıklarının detayları haberimizde. 👇 https://indirlab.com/habeBluesky: CVE posts, 24 Oct 2026
- @alt.pds.lefht.cc: 2. CVE-2026-109618 · 50 people 🟥 Critical 9.2 · PHP RCE via OOM corruptionBluesky: CVE posts, 24 Oct 2026
- @alt.pds.lefht.cc: 🛡️ Most-discussed CVEs on Bluesky, last 24h 1. CVE-2026-111497 · 55 people 2. CVE-2026-109618 · 50 people 3. CVE-2026-109619 · 38 people 4. CVE-2026-115560 · 20 people 5. CVE-2026-Bluesky: CVE posts, 24 Oct 2026Exploitation reported
- @icsda.bsky.social: 📘 ICSDA 資安小教室｜PHP2Shell 10/25 最新狀況與處置清單： https://icsda.org.tw/php2shell-cve-2026-109618-109619/ #ICSDA #資安小教室Bluesky: CVE posts, 24 Oct 2026
- @privpros.bsky.social: Two long-dormant PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) enabled passwordless compromise of PHP servers, prompting urgent patching worldwide.Bluesky: CVE posts, 24 Oct 2026
- @infosecbriefly.bsky.social: Two long-dormant PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) enabled passwordless compromise of PHP servers, prompting urgent patching worldwide.Bluesky: CVE posts, 24 Oct 2026
- @devopsbriefly.bsky.social: Two long-dormant PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) enabled passwordless compromise of PHP servers, prompting urgent patching worldwide.Bluesky: CVE posts, 24 Oct 2026
Description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Text from CVE List
Affected versions 8
- PHPaffected: 8.2.* before 8.2.35CVE List
- PHPaffected: 8.3.* before 8.3.36CVE List
- PHPaffected: 8.4.* before 8.4.27CVE List
- PHPaffected: 8.5.* before 8.5.12CVE List
- php-src, php< 8.2.35GitHub
- php-src, php< 8.3.36GitHub
- php-src, php< 8.4.27GitHub
- php-src, php< 8.5.12GitHub