blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2026-109618

CRITICAL 9.2 CVSS 4.0
Published
October 21, 2026
Last modified
November 5, 2026
NVD status
Analyzed
Reported by
security@php.net
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Affected products and versions

  • PHP — From 7.3.0 (including) to 8.2.35 (excluding)
  • PHP — From 8.3.0 (including) to 8.3.36 (excluding)
  • PHP — From 8.4.0 (including) to 8.4.27 (excluding)
  • PHP — From 8.5.0 (including) to 8.5.12 (excluding)

References

  • github.com https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w Mitigation, Vendor Advisory
  • seclists.org http://seclists.org/fulldisclosure/2026/Oct/51 Mailing List
  • www.openwall.com http://www.openwall.com/lists/oss-security/2026/10/21/6 Mailing List, Third Party Advisory
  • www.openwall.com http://www.openwall.com/lists/oss-security/2026/10/23/5 Mailing List, Third Party Advisory
  • arcticwolf.com https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/ Third Party Advisory
  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-166980.html Third Party Advisory
  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-566435.html Third Party Advisory
  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-566512.html Third Party Advisory
  • php2shell.delftintellab.com https://php2shell.delftintellab.com Third Party Advisory
  • www.cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618 US Government Resource
  • www.wiz.io https://www.wiz.io/blog/php2shell-php-rce Third Party Advisory
  • nvd.nist.gov Official NVD record