CVE-2026-109618
PHP: use-after-free can lead to remote code execution
- Risk score
- 100/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 11.8%
- Published
- 24 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- PHP uses longjmp() for out-of-memory (OOM) errors, which can lead to remote code execution (RCE). An attacker could exploit this vulnerability to execute arbitrary code on a targeted system.
- Affected
- {'products': ['PHP'], 'packages': [], 'versions': ['all versions']}
- Fix
- Check the linked advisory for a fix, as none is provided in the record.
- Exploitation
- Exploitation reported in the press
Story map
At a glance
PHP2Shell: Red, act today. PHP uses longjmp() for out-of-memory (OOM) errors, which can lead to remote code execution (RCE). An attacker could exploit this vulnerability to execute arbitrary code on a targeted system.
The flaws
- CVE-2026-109618: Use-after-free can lead to remote code execution (CVSS 9.8 · EPSS 12%)
- CVE-2026-109619: PHP has various global state that temporarily points into request memory (CVSS 8.1 · EPSS 6%)
- CVE-2026-91765: Denial of service (CVSS 7.5 · EPSS 1%)
- CVE-2026-17545: On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN… (CVSS 7.5 · EPSS 0%)
The fix
Fix: Check the linked advisory for a fix, as none is provided in the record.
Who is exposed: {'products': ['PHP'], 'packages': [], 'versions': ['all versions']}
Where it stands
- Exploitation reported in the press
- 6 outlets covering it
How it unfolded
- 24 Sep, PHP releases (official): PHP 8.3.35 Released!
- 24 Sep, PHP releases (official): PHP 8.5.11 Released!
- 21 Oct, The Hacker News (press): PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
- 21 Oct, Infosecurity Magazine (press): Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
- 21 Oct, CISA advisories (US) (official): Critical Vulnerabilities in PHP Require Immediate Patching
- 21 Oct, Ubuntu security notices (official): USN-8948-2: PHP vulnerabilities
- 21 Oct, PHP releases (official): PHP 8.6.0 RC4 available for testing
- 23 Oct, PHP releases (official): Informational advisory: Session upload progress
- 23 Oct, SecurityWeek (press): Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- 23 Oct, BleepingComputer (press): PHP shares mitigation for new RCE vulnerability with no patch
- 23 Oct, Dark Reading (press): Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
- 25 Oct, Help Net Security (press): Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw
Connects to
- Same weakness: Use-after-free (CWE-416). 398 other warnings in 30 days
- Same product: Earlier PHP warnings. 7 in the last 90 days
- Reported alongside: PHP: with the next release. CVE-2026-115560 · in 1 of the same article
In the news
TL;DR
PHP uses longjmp() for OOM errors, leaving request memory uninitialized, potentially leading to RCE. Critical vulnerability (CVE-2026-109618) with CVSS 9.8. Exploitation in the wild reported, but experts downplay viability of exploits.
- PHP patched two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Over 5.1 million PHP hosts are exposed online, and roughly 3.8 million have at least one port open to attacks.
- Experts downplay viability of exploits, saying most available proof-of-concept exploits only work in ideal lab conditions.
- Several government, school and hospital websites in Europe went dark on October 21 due to precautionary measures taken while patches were applied.
AI summary of 12 articles.
- Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw
- Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
- PHP shares mitigation for new RCE vulnerability with no patch
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
- Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
- Amazon says PHP2Shell exploitation began 4 days before patches
- PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
- Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
- 'PHP2Shell' Bugs Signal Red Alert for Security Industry
- Widespread PHP Flaw May Cause Many Site Outages Today
Why it is Red
- CVSS 9.8 critical
- Exploitation likely: EPSS 11.8% (top 4%)
- Remotely exploitable without logging in
- On your watchlist: php
- Named in a government or vendor bulletin
Government and vendor bulletins
- PHP 8.6.0 RC4 available for testing
- USN-8948-2: PHP vulnerabilities
- Critical Vulnerabilities in PHP Require Immediate Patching
- Critical security issue affecting PHP
- Security advisory: Critical remote code execution vulnerabilities, update now
- PHP 8.5.12 Released!
- PHP 8.4.27 Released!
- PHP 8.3.36 Released!
- PHP 8.2.35 Released!
- Upcoming Critical PHP Security Release
References
- https://ubuntu.com/security/notices/USN-8948-2
- https://www.php.net/index.php#2026-10-21-5
- https://www.php.net/index.php#2026-10-21-4
- https://www.php.net/index.php#2026-10-21-3
- https://www.php.net/index.php#2026-10-21-2
- https://www.php.net/index.php#2026-10-21-1
- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- http://www.openwall.com/lists/oss-security/2026/10/21/6
- http://www.openwall.com/lists/oss-security/2026/10/23/5
- https://cert-portal.siemens.com/productcert/html/ssa-566512.html
Original description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Last activity 21 Oct 2026. Patch Forecast updates every hour.