PHP says out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid. It is one of two flaws called PHP2Shell, rated 9.2 on CVSS v4.0, and is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What it allows
PHP says the two PHP2Shell flaws can allow unauthenticated remote code execution. For this one, the GitHub advisory says PHP uses longjmp() to leave the current context on an out-of-memory error. Request memory can be reachable before initialization finishes, so a failed allocation can leave it invalid, and shutdown may then read it.
The advisory says several out-of-memory strategies can lead to remote code execution and names multipart parsing issues as one trigger. PHP rates the risk highest for mod_php, where it has a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs.
PHP's release text does not report exploitation. NCSC-NL notes that public proof-of-concept exploits exist, and Sansec reports early attacks seen by Cloudflare on 21 October. Our own search found about 380 new GitHub repositories in the first 36 hours that mention PHP2Shell, and we cannot vouch for any of them. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 26 October, with a due date of 29 October and known ransomware campaign use listed as "Unknown".
Read the PHP2Shell analysis for the full picture. Matching new flaws like this to the software you run is the job of a vulnerability intelligence service. The second flaw is covered on the CVE-2026-109619 page.
In a note on 23 October, PHP named a separate id, CVE-2026-115560, for a related session upload progress path.
Who is affected
PHP's GitHub advisory lists every release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as affected. PHP says all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.2 reaches end of life on 31 December 2026. PHP says 8.1 and older no longer receive updates from the PHP project, and some distributions and LTS vendors provide backported fixes. The advisory does not say how far back older branches are affected.
Palo Alto Networks lists PAN-OS and Panorama as affected downstream, and says active exploitation has been observed against management interfaces exposed to the internet. It had released 14 of 20 hotfixes by 28 October; see our Palo Alto product status post.
Timeline
- 20 Oct 2026
The PHP security team announces a security release for two critical flaws, both rated 9.2 on CVSS v4.0.
- 20 Oct 2026
CERT-EU advisory 2026-018 names CVE-2026-109618 and CVE-2026-109619.
- 21 Oct 2026
PHP publishes the GitHub advisory GHSA-w8hw-w9fx-j79w and releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- 21 Oct 2026
PHP says 8.1 and older get no update from the PHP project and points to vendor backports.
- 24 Oct 2026
A researcher's honeypot report records 35 shells started by Apache workers on three PHP 8.4.26 honeypots right after exploit requests, consistent with this flaw. See our main PHP2Shell analysis.
- 26 Oct 2026
CISA adds the CVE to its Known Exploited Vulnerabilities catalog with a due date of 29 October. It lists known ransomware campaign use as "Unknown" and marks forensic triage as required.
- 27 Oct 2026
Wiz Research publishes a status report. It says it has not yet seen successful end-to-end exploitation in its own telemetry. It also reports about a 67% fall in distinct internet-exposed machines vulnerable to PHP2Shell since disclosure. See our main PHP2Shell analysis.
- 28 Oct 2026
Palo Alto's advisory says active exploitation has been observed targeting the PAN-OS management interface when it is exposed to the internet, and rates the issue Critical. See our PAN-OS hotfix dates.
What to do
-
Update PHP
Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the vendor package that carries the fix. PHP says updating is the only complete solution.
-
Find every PHP runtime
List servers, containers, control panels and appliances that run PHP, with the version of the binary your web server really uses. Start with the ones reachable from the internet.
-
Reduce exposure if you cannot update
PHP suggests memory_limit=-1 set with php_admin_value, and a low post_max_size. It says these cut one attack path but do not make an installation safe.
-
Restart and confirm
Restart PHP-FPM or the web server so workers load the new code, then confirm the version again. For 8.1 and older, ask your vendor for a backport or upgrade.
-
Look for signs of abuse
Watch for PHP worker processes that start shells or download tools, and for new files in web roots. A researcher's honeypot report of 24 October lists the source addresses and request-body hashes it saw. Wiz lists addresses seen in PHP2Shell exploitation attempts, scanning and as a payload server between 21 and 26 October.
What Brandefense can do
- Check CVE-2026-109618 in Brandefense Atlas, free
See the current status of CVE-2026-109618 in Brandefense Atlas, with the sources behind it.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-109618?
It is a critical PHP flaw, rated 9.2 on CVSS v4.0, that PHP titles "RCE via OOM corruption". An out-of-memory error can interrupt PHP while request data is only partly initialized. It is one of the two flaws called PHP2Shell.
Which PHP versions fix CVE-2026-109618?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. The GitHub advisory lists releases before these versions as affected.
Does PHP fix older branches?
No. PHP says 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so ask your vendor or upgrade.
How does it differ from CVE-2026-109619?
CVE-2026-109618 comes from out-of-memory handling that leaves request data invalid. CVE-2026-109619 comes from request state that survives after its memory is freed. See the CVE-2026-109619 page.
Sources
- Security advisory: Critical remote code execution vulnerabilities, update now (21 October 2026)PHP.net
- RCE via OOM corruptionGitHub
- PHP 8.5.12 Released! (21 October 2026)PHP.net
- Known Exploited Vulnerabilities catalog: CVE-2026-109618 (added 26 October 2026)CISA
- Security Advisory 2026-018: Critical Vulnerabilities in PHPCERT-EU
- PHP2Shell: Exploitation Attempts and Remediation Trends (27 October 2026)Wiz Research
- Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619Sansec
- PHP2Shell confirmed code execution on honeypots, 24 October 2026Honeypot researcher (GitHub)
