PHP2Shell (CVE-2026-109618)
RCE via OOM corruption
Also Known as PHP2Shell
Part of the PHP2Shell pair of PHP core flaws fixed on October 21, 2026; this CVE is the out-of-memory corruption flaw, where request cleanup can treat partially initialized data as valid. Wiz Research combined both flaws into one exploit script named PHP2Shell. CISA states they allow unauthenticated remote code execution on all PHP installations serving web requests.
Name sources
- Security advisory: Critical remote code execution vulnerabilities, update now (PHP)
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet (Wiz)
- Critical Vulnerabilities in PHP Require Immediate Patching (CISA)
- Two Critical PHP Flaws Could Hand Attackers Your Web Servers (Qualys)
Description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NExploitation Context
as of October 23, 2026- Its current EPSS score (5.3%) is higher than that of 19% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| PHP Group | PHP Group PHP | 8.2.* to <8.2.35 8.3.* to <8.3.36 8.4.* to <8.4.27 8.5.* to <8.5.12 |
References
2 LinksRecord Details
More from PHP Group
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.