CVE-2026-109618

CVE-2026-109618 is a flaw in PHP core. PHP calls it "RCE via OOM corruption". It was fixed on 21 October 2026.

PHP uses a jump out of the current code when it runs out of memory. In some places, request memory is reachable before it is fully set up. If any allocation fails there, PHP leaves that memory in an invalid state. Request cleanup can then read it.

PHP lists several ways to push a request into out-of-memory while it stays within normal limits. Most involve multipart request parsing. Examples are part headers with no count limit and empty file fields that still build arrays.

The confirmed impact is unauthenticated remote code execution as the web worker account. PHP validated a full exploit over HTTP against Apache mod_php with default limits. It runs before any application code. PHP says FPM is susceptible from source analysis, but no complete FPM exploit was shown. FrankenPHP and LiteSpeed are likely affected too.

PHP rates it CVSS 4.0 9.2. The full vector is in the CVSS field. NVD published its entry on 21 October and added its own CVSS 3.1 score of 9.8.

Fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP also shared minimal source backports for 7.4, 8.0 and 8.1. The fix replaces the jump with a delayed, graceful out-of-memory stop.

PHP says updating is the only complete fix. If you cannot patch now, PHP suggests memory_limit=-1 set by the admin, a low post_max_size and request limits at the proxy. These reduce risk but do not make a server safe.

Credits go to Ryan at Calif.io, Wiz and OpenAI, per the CVE record. The fix was built by Arnaud Le Blanc, Ilija Tovilo, Jakub Zelenka and Nora Dossche.

On 21 October, CISA issued an alert urging immediate patching. It calls the flaws "php2shell" and says they affect all PHP installations serving web requests. CISA says systems that cannot be updated, or that run PHP 8.1 or older, should go offline until patched. The UK NCSC issued a similar alert.

Vendor fixes are out from Debian, Ubuntu, Red Hat, the Docker official php images and cPanel. Researchers say the flawed code dates back to PHP 5.4, so treat older PHP as exposed. See the vendor list and full checklist.

Exploitation update, 22 October: Amazon said on October 21 that its MadPot honeypots logged a PHP2Shell exploit attempt on October 17, four days before disclosure. It does not know how the attacker got the details early, or which of the two CVEs was targeted. Amazon now says PHP2Shell is being broadly exploited in the wild. ELLIO and VulnCheck saw attempts from 08:36 UTC on October 21. No confirmed compromise is public. Read the full story.

The CVE is not in the CISA KEV catalog (catalog 2026.10.21). Cloudflare reported attack attempts before the release. CISA had observed no exploitation at publication. Detailed research write-ups are now public. ThreatWire has not verified or run any exploit code. Read the full explainer. The twin flaw is CVE-2026-109619.