CVE-2026-109618: Remote Code Execution in PHP Core via Out-of-Memory longjmp() Uninitialized Memory Access

Vulnerability ID: CVE-2026-109618
CVSS Score: 9.8
Published: 2026-10-21

CVE-2026-109618 (dubbed PHP2Shell) is a critical vulnerability in the PHP engine core resulting from improper out-of-memory exception handling via longjmp(). When request allocation fails mid-processing, non-local control flow bypasses cleanup procedures, leaving memory structures uninitialized or in a use-after-free state during request shutdown.

TL;DR

Unauthenticated remote attackers can trigger an out-of-memory error during PHP request processing, causing non-local longjmp() unwinding that leaves memory structures uninitialized and results in arbitrary code execution during request shutdown.

Technical Details

• CWE ID: CWE-416 / CWE-824
• Attack Vector: Network (Unauthenticated)
• CVSS v3.1 Score: 9.8 (Critical)
• CVSS v4.0 Score: 9.2 (Critical)
• EPSS Score: 0.05307 (92.56th percentile)
• Impact: Remote Code Execution (RCE)
• Exploit Status: Proof of Concept Available
• CISA KEV Status: Not Listed

Affected Systems

• PHP 8.2 Branch < 8.2.35
• PHP 8.3 Branch < 8.3.36
• PHP 8.4 Branch < 8.4.27
• PHP 8.5 Branch < 8.5.12
• PHP End-of-Life Branches (5.4.x - 8.1.x) with session.upload_progress enabled

Mitigation Strategies

• Upgrade PHP core runtime to a patched version immediately.
• Disable session.upload_progress in php.ini if immediate patching is not possible.
• Implement Web Application Firewall (WAF) filtering on multipart POST parameters.

Remediation Steps:

1. Identify all server instances and container base images running vulnerable PHP versions.
2. Update PHP packages to version 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
3. Set session.upload_progress.enabled = Off in php.ini as an interim mitigation.
4. Restart PHP-FPM or web server daemon processes to apply settings.

Read the full report for CVE-2026-109618 on our website for more details including interactive diagrams and full exploit analysis.