CVE-2026-109618: PHP remote code execution via out-of-memory corruption

What is CVE-2026-109618?

CVE-2026-109618 is one of the two PHP2Shell vulnerabilities. PHP’s official title is “RCE via OOM corruption”. When a memory allocation fails part-way through preparing request data, PHP’s cleanup path can touch data that was never fully set up. Corrupting memory this way can let an attacker execute code through ordinary web requests.

The GitHub advisory rates it Critical, CVSS 4.0 score 9.2, vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N: reachable over the network with no login and no user interaction, though attack complexity is rated high and certain conditions must be present.

Which PHP versions are affected by CVE-2026-109618?

Every supported branch below its fixed release is affected. Older branches are too: PHP published source patches for 7.4, 8.0 and 8.1 but no new releases, and the original research reports that at least one PHP2Shell flaw reaches back to PHP 5.4.

Linux distributions publish their own fixed packages, often with older-looking version numbers. The table below also lists images, panels and hosts whose status we haven’t verified yet:

How do I fix CVE-2026-109618?

Update the PHP that serves your website to the fixed release for its branch (or newer), or install your distribution’s patched package, then restart every PHP worker (PHP-FPM pools or Apache). The fix for CVE-2026-109618 ships in the same releases as CVE-2026-109619, so one update covers both. Step-by-step instructions: PHP2Shell patch guide.

For PHP 7.4, 8.0 and 8.1, PHP published minimal source patches but no new releases; older branches have no official patch. See PHP end of life.

Why can running out of memory be exploited?

Normally, PHP stopping a request because it hit its memory limit is just an error. With CVE-2026-109618, an attacker can arrange for that failure to happen at a moment when PHP’s internal data is only half set up. The cleanup that follows then works on inconsistent data, and corrupted memory can be steered towards running code. Hiding error messages doesn’t help: PHP says error_reporting, display_errors and @ make no difference.

Is there a workaround for CVE-2026-109618?

Not a complete one. PHP lists stopgaps that reduce exposure, such as removing the PHP memory limit and lowering post_max_size, but says they don’t make an installation safe; an underlying allocation failure can still reach the vulnerable code. Details and limits: CVE-2026-109618 workaround.

How do I know if my server is affected by CVE-2026-109618?

Find the PHP version and setup your website actually uses and enter it in the PHP version checker. A command-line php -v can show a different PHP than the website; the check PHP version guide explains where to look.

Is CVE-2026-109618 exploited in the wild?

Attack attempts have been reported, but successful compromise has not been confirmed. Cloudflare reported PHP2Shell attack traffic against its customers before the fix was released. None of the sources we checked as of 22 Oct 2026 confirms a successful takeover, and we don’t link to exploit code. Treat unpatched web-facing PHP as exposed and update.

What is the difference between CVE-2026-109618 and CVE-2026-109619?

CVE-2026-109618 is about memory corruption when an allocation fails during request setup. CVE-2026-109619 is about stale state from a finished request being reused by a later one. They’re fixed in the same releases and together are called PHP2Shell. Overview: PHP2Shell vulnerability · PHP2Shell checker.

Which sources support this page?

• GitHub advisory GHSA-w8hw-w9fx-j79w
• The PHP Group: security advisory
• Wiz Research: original research
• Canonical: Ubuntu CVE page
• Cloudflare: WAF protections