CVE-2026-109618criticalunder attackCWE-1325 CWE-1419 CWE-416 CWE-755 CWE-824

CVE-2026-109618: critical vulnerability in PHP

RCE via OOM corruption

Published 21 Oct 2026 · Updated 29 Oct 2026

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 9.2epss 100%

from disclosure to weapon0 days

Published on NVDOct 21

1st PoCOct 18

CISA KEV+5d

exploitation probability

100%top 1% of all CVEs

observed exploitation

yesCISA + VulnCheck

826 public exploit(s)

Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

CISC Gov.br · 23 Oct 2026[Atualização] Vulnerabilidades críticas de execução remota de código PHPread on gov.br ↗
CTIR Gov · RECOMENDAÇÃO 21/2026 · 22 Oct 2026Recomendação de Segurança – PHP (CVE-2026-115560)read on gov.br ↗
CTIR Gov · RECOMENDAÇÃO 20/2026 · 22 Oct 2026Recomendação Técnica – Diretrizes de Endurecimento (Hardening): Ocultação de Banners Tecnológicos e Versõesread on gov.br ↗
CISC Gov.br · 21 Oct 2026Vulnerabilidades crí´ticas de execução remota de código PHPread on gov.br ↗
CTIR Gov · ALERTA 93/2026 · 21 Oct 2026Vulnerabilidades críticas que afeta o PHPread on gov.br ↗

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.

Action required by CISAfederal deadline: 2026-10-29

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

A flaw in PHP can corrupt memory when the server runs out of memory while handling a request. Attackers may be able to use this to run their own commands on the server remotely.

Technical detail

PHP exits from out-of-memory errors via longjmp(), but some contexts leave request memory uninitialized before an allocation. The request cleanup routine then reads or branches on that memory, causing memory corruption; multiple OOM strategies reliably trigger the condition. A remote attacker who can drive the application into memory exhaustion may achieve remote code execution (CVSS 9.2, CWE-416/824/755).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

PHP Group · PHP

public PoCs found — 826✓ VexDay Proof

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — PHP

In the same product, most dangerous first.

CVE-2026-109619CRITICALRCE via stale global stateEPSS 100.0%KEV CVE-2024-4577CRITICALArgument Injection in PHP-CGIEPSS 100.0%KEV CVE-2022-31626HIGHmysqlnd/pdo password buffer overflowEPSS 58.1%CVE-2022-31629MEDIUM$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesEPSS 49.6%CVE-2024-2756MEDIUM__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fixEPSS 38.1%CVE-2024-1874CRITICALCommand injection via array-ish $command parameter of proc_open()EPSS 32.6%

References

https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/https://cert-portal.siemens.com/productcert/html/ssa-566512.html http://seclists.org/fulldisclosure/2026/Oct/51 https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w https://php2shell.delftintellab.com https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618 https://www.wiz.io/blog/php2shell-php-rce http://www.openwall.com/lists/oss-security/2026/10/21/6 http://www.openwall.com/lists/oss-security/2026/10/23/5