Remote Code Execution Risk in PHP Software
CVE-2026-109618

9.2CRITICAL

Key Information:

Vendor

PHP Group

Status
PHP
Vendor
CVE Published:
21 October 2026

Badges

👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-109618?

CVE-2026-109618 is a serious vulnerability affecting the PHP programming language, which is widely used for server-side web development. This vulnerability poses a remote code execution (RCE) risk due to improper handling of out-of-memory (OOM) errors. Specifically, PHP employs the longjmp() function to manage OOM situations, but certain contexts may not adequately reset memory allocations, leaving parts of memory in an uninitialized state. When the server processes requests, it might inadvertently read from or execute this uninitialized memory, potentially allowing an attacker to inject arbitrary code. Given the extensive use of PHP across various web applications, this vulnerability could have far-reaching implications for organizations, enabling unauthorized control over affected systems and compromising sensitive data.

Potential impact of CVE-2026-109618

  1. Remote Code Execution: The primary impact of CVE-2026-109618 is the potential for remote code execution, allowing attackers to run arbitrary code on affected servers. This can lead to complete system compromise, including the theft of credentials, access to sensitive information, and the ability to modify server configurations.

  2. Data Breaches: Exploiting this vulnerability can result in significant data breaches, as unauthorized code execution may give attackers access to databases and user data. Organizations could face legal and financial ramifications due to data protection regulations, resulting in reputational damage and loss of customer trust.

  3. Increased Malware Propagation: The risk of malware deployment increases significantly due to the ability of attackers to execute arbitrary code. This could lead to the installation of backdoors or ransomware, which can further compromise the security of the affected environment and potentially spread to other interconnected systems, amplifying the attack's impact.

Affected Version(s)

PHP 8.2.* < 8.2.35

PHP 8.3.* < 8.3.36

PHP 8.4.* < 8.4.27

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-109618
Created by Zer061

php2shell-protection
Created by syhunt

CVE-2026-109618-109619-audit
Created by xuehuolll

News Articles

favicon imageThe Hacker News

PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

PHP patches two critical RCE flaws affecting web servers as Cloudflare reports early exploit attempts, with no confirmed breaches.

2 hours ago

favicon imageBleepingComputer

PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.

2 hours ago

favicon imageThe Hacker News

PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't

Disabling PHP Session Upload Progress does not fully mitigate PHP2Shell; fixes for two critical flaws are scheduled for October 21.

6 hours ago

References

https://github.com/php/php-src/security/advisories/GHSA-w...
vendor-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • 📰

    First article discovered by BleepingComputer

  • Vulnerability Reserved

Credit

Ryan at Calif.io
Wiz
OpenAI
Arnaud Le Blanc
Ilija Tovilo
Jakub Zelenka
Nora Dossche
.