CVE-2026-109618
9.2 critical
KEV · due 2026-10-29
exploit ×737
SSVC exploitation: active
Analyzed
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Fix
Public exploits 737
- PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE (remote · php) Exploit-DB · verified · 2026-10-22
- 0-draft/php2shell-anatomy PoC on GitHub
- 0k1dok1/CVE-2026-109618-CHECK PoC on GitHub
- 0ldbaby/php2shell PoC on GitHub
- 0x1c1101/CVE-2026-109618-PoC PoC on GitHub
- 0x4148/CVE-2026-109618-php2shell-lab PoC on GitHub
- 0xBlackash/CVE-2026-109618 PoC on GitHub
- 0xgitpushpray/php2shell PoC on GitHub
- 0xrsydn/php2shell-scan PoC on GitHub
- 1Nightlovel/CVE-2026-109618 PoC on GitHub
- 1amrahul/php2shell-cve-2026-109618-cve-2026-109619 PoC on GitHub
- 1o-ya/php-cve-2026-109618-hotfix-guide PoC on GitHub
- 463861437/guard-for-php74 PoC on GitHub
- 4B3R4M4-607D/php2shell PoC on GitHub
- 4itec/php-7.4.3.3-patch PoC on GitHub
- 5WARM-AI/php2shell-check PoC on GitHub
- 87sunitasingh-droid/RHYTHM-SINGH PoC on GitHub
- 9hb/php2shell-poc PoC on GitHub
- AGI-CEO/php2shell-wordpress-to-nextjs-mcp PoC on GitHub
- AIjennings/ariawave-php2shell-scanner PoC on GitHub
- and 717 more
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
CISA KEV required action · due 2026-10-29
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Added to the catalog 2026-10-26. CISA KEV
Patch, vendor advisory and mitigation references on NVD 1
- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w Mitigation, Vendor Advisory
Vendor advisories in the News 6
- CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL) Palo Alto Networks Security Advisories · 2026-10-27
- Vulnerabilities in PHP Affecting Cisco Products: October 2026 Cisco Security Advisories · 2026-10-23
- PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) AWS Security Bulletins · 2026-10-21
- USN-8948-2: PHP vulnerabilities Ubuntu Security Notices · 2026-10-21
- USN-8948-1: PHP vulnerabilities Ubuntu Security Notices · 2026-10-21
- PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619) Fortinet PSIRT Advisories · 2026-10-21
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
In the news 10
- CISA confirms PHP2Shell vulnerabilities now exploited in attacks r/cybersecurity · 2026-10-27
- CISA confirms PHP2Shell under attack as researchers clock successful exploits The Register · Security · 2026-10-27
- U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog Security Affairs · 2026-10-27
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution The Hacker News · 2026-10-27
- PHP2Shell Sentinel — PHP CVE-2026-109618 & CVE-2026-109619 Mitigation Tool & WAF r/cybersecurity · 2026-10-26
- PHP2Shell: What to know about two critical PHP flaws WeLiveSecurity (ESET) · 2026-10-26
- CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA advisories and alerts · 2026-10-26
- PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts Security Affairs · 2026-10-26
- PHP2Shell security flaws now sucessfully exploited in the wild BleepingComputer · 2026-10-26
- Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25) - "We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23." r/blueteamsec · 2026-10-26
Change history 17
- References+3 references (now 8)NVD modified 2026-10-27 13:43
- CISA KEVadded to CISA KEV, due 2026-10-29
- Cpes+289 CPE criteria (now 290)NVD modified 2026-10-23 16:26
- StatusPublished → AnalyzedNVD modified 2026-10-23 16:26
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-23 14:07
- References+2 references (now 5)NVD modified 2026-10-23 15:17
- StatusAnalyzed → Undergoing AnalysisNVD modified 2026-10-23 15:17
- StatusModified → AnalyzedNVD modified 2026-10-22 20:45
- References+1 references (now 3)NVD modified 2026-10-21 17:18
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-21 17:18
- StatusPublished → ModifiedNVD modified 2026-10-21 17:18
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-21 14:36
- CwesCWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 → CWE-416, CWE-755, CWE-824, CWE-1325NVD modified 2026-10-21 16:13
- References+1 references (now 2)NVD modified 2026-10-21 16:13
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-21 16:13
- CVSS9.2 (v4.0, CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) → 9.2 (v4.0, CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)NVD modified 2026-10-21 16:13
- First seenCVSS 9.2 · php groupNVD modified 2026-10-21 13:48
Affected (CPE criteria) 290
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h10:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h11:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h13:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h14:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h15:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h17:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h20:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h22:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h23:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h24:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h32:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h34:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h35:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h36:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h37:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h38:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h5:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h7:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h9:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:*:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:*:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:*:*:*:*:*:*- and 250 more
References 8
- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w Mitigation, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/6 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/23/5 Mailing List, Third Party Advisory
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/ Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-566512.html Third Party Advisory
- https://php2shell.delftintellab.com Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618 US Government Resource
- https://www.wiz.io/blog/php2shell-php-rce Third Party Advisory