/Vulnerability Library

PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection

CVE-2026-109618
Verified

Description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Severity

Critical

CVSS Score

9.2

Exploit Probability

100%

Affected Product

php

Published Date

October 21, 2026

Template Author

lcfr_hax, assetnote, princechaddha
+1

CVE-2026-109618.yaml
9.2Score

CVSS Metrics

CVSS Vector:
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVE ID:
cve-2026-109618
CWE ID:
cwe-416

References

https://www.php.net/index.php#2026-10-21-5https://www.php.net/archive/2026.phphttps://cert.europa.eu/publications/security-advisories/2026-018https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79whttps://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rphttps://www.wiz.io/blog/php2shell-php-rcehttps://github.com/assetnote/php2shell-scanner

Remediation Steps

Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12, or later. PHP 8.1 and older are end-of-life upstream; upgrade to a supported branch or apply vendor backports for both CVE-2026-109618 and CVE-2026-109619.