Remote Code Execution Risk in PHP Software
CVE-2026-109618

9.2CRITICAL

Key Information:

Vendor: PHP Group
Status: PHP
Vendor: CVE Published:; 21 October 2026

Badges

🔥 Trending now🥇 Trended No. 1📈 Trended📈 Score: 1,530,000💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 99%🦅 CISA Reported📰 News Worthy

What is CVE-2026-109618?

CVE-2026-109618 is a serious vulnerability affecting the PHP programming language, which is widely used for server-side web development. This vulnerability poses a remote code execution (RCE) risk due to improper handling of out-of-memory (OOM) errors. Specifically, PHP employs the longjmp() function to manage OOM situations, but certain contexts may not adequately reset memory allocations, leaving parts of memory in an uninitialized state. When the server processes requests, it might inadvertently read from or execute this uninitialized memory, potentially allowing an attacker to inject arbitrary code. Given the extensive use of PHP across various web applications, this vulnerability could have far-reaching implications for organizations, enabling unauthorized control over affected systems and compromising sensitive data.

Potential impact of CVE-2026-109618

Remote Code Execution: The primary impact of CVE-2026-109618 is the potential for remote code execution, allowing attackers to run arbitrary code on affected servers. This can lead to complete system compromise, including the theft of credentials, access to sensitive information, and the ability to modify server configurations.
Data Breaches: Exploiting this vulnerability can result in significant data breaches, as unauthorized code execution may give attackers access to databases and user data. Organizations could face legal and financial ramifications due to data protection regulations, resulting in reputational damage and loss of customer trust.
Increased Malware Propagation: The risk of malware deployment increases significantly due to the ability of attackers to execute arbitrary code. This could lead to the installation of backdoors or ransomware, which can further compromise the security of the affected environment and potentially spread to other interconnected systems, amplifying the attack's impact.

CISA has reported CVE-2026-109618

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-109618 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

PHP 8.2.* < 8.2.35

PHP 8.3.* < 8.3.36

PHP 8.4.* < 8.4.27

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

php2shell-scanner
Created by assetnote

php2shell-fixed
Created by Qsnh

CVE-2026-109618
Created by Zer061