PHP OOM Handling Memory Corruption Enables Unauthenticated RCE
PHP OOM handling leaves request memory uninitialized before cleanup runs, enabling unauthenticated RCE. CVSS 9.8 critical. Patched in PHP 8.3.36, 8.4.27, and 8.5.12.
- Vendor
- PHP
- Product
- PHP core (before 8.3.36, 8.4.x before 8.4.27, 8.5.x before 8.5.12)
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Is CVE-2026-109618 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-109618 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-22 snapshot. That can change quickly; check the write-up below for the latest reporting.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
CVE-2026-109618 timeline
- Exploitation reportedsame day as NVDExploitation attempts detected on sensors same day patches shipped
- Published to NVD
- Patch availablesame day as NVDFixed in PHP 8.3.36, 8.4.27, 8.5.12
- First 0dayNews coverage+1d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-109618 is one of two PHP core remote code execution flaws collectively called PHP2Shell. Both carry a CVSS 9.8 critical rating from NVD.
PHP uses longjmp() to handle out-of-memory conditions, aborting the current request context. In some code paths, this exit leaves request memory in an uninitialized state before an allocation is performed. The subsequent request cleanup procedure may then read from or branch on that uninitialized memory. Attackers can trigger this condition reliably through multiple out-of-memory strategies, producing remote code execution with no authentication required.
Cisco Talos reported that the flaw is triggerable via a plain HTTP request before any application-level code runs. SecurityWeek observed exploitation attempts hitting sensors on the same day patches shipped.
Affected installs include WordPress, Drupal, Joomla, and any PHP-backed application running a vulnerable runtime.
Remediation: Update to PHP 8.3.36, 8.4.27, or 8.5.12. PHP 8.0, 8.1, and 8.2 are end-of-life and will receive no patch; those deployments require a PHP version upgrade.
Sources: NVD, Rapid7 analysis, BleepingComputer.
Other PHP CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-109619 PHP Stale Global State Across Requests Enables Unauthenticated RCEwrite-up | [ CRITICAL ] | 9.8 | — | — |
| CVE-2016-10033 PHPMailer Command Injection Vulnerability | [ CRITICAL ] | 9.8 | 99.7% | |
| CVE-2019-11043 PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerabilityransomware use | [ HIGH ] | 8.7 | 99.7% | |
| CVE-2012-1823 PHP-CGI Query String Parameter Vulnerability | [ CRITICAL ] | 9.8 | 100.0% |
