CVE-2026-109618: PHP Out-of-Memory longjmp Corruption Allows Unauthenticated RCE

Background

PHP is the server-side language behind a large share of the web, and it also ships embedded in appliances and other software. CISA’s alert says the flaws behind “php2shell” affect all PHP installations serving web requests and that PHP “may not be directly observable” inside other products. CVE-2026-109618 is one of two CVEs disclosed together on October 21, 2026. The other, CVE-2026-109619, has its own Vuln Brief article.

Technical Mechanism

The PHP GHSA (GHSA-w8hw-w9fx-j79w, “RCE via OOM corruption”) and the CISA KEV entry list CWE-416, CWE-755, CWE-824, CWE-1325 and CWE-1419; the NVD record lists four of them (no CWE-1419). NVD (primary) scores CVSS 3.1 at 9.8; PHP’s CNA scores CVSS 4.0 at 9.2 (secondary). The NVD description says PHP uses longjmp() for out-of-memory (OOM) errors to abort the current request context. Some contexts leave request memory uninitialized before an allocation, and the cleanup procedure “may read or branch on this memory.” The advisory adds that multiple OOM strategies can trigger this consistently.

The attack flow, per the advisory:

1. An unauthenticated client sends a request that exhausts memory. Multipart parsing is the documented route: missing content length checks, unlimited headers per part, and empty file controls with nested field names. Application-specific allocations can also do it.
2. PHP calls longjmp() out of the failed allocation, skipping initialization.
3. Request shutdown still runs and processes the invalid state before any application code executes.

Susceptibility varies by SAPI. The advisory marks Apache mod_php as confirmed, because shutdown runs even after a failed startup. PHP-FPM is suggested by source analysis but no complete exploit was demonstrated for this CVE. The advisory calls FrankenPHP likely susceptible to application-independent attacks, and says application-specific exploits against LSAPI are likely but unvalidated. CISA’s alert separately lists php-cgi, FrankenPHP and LiteSpeed among affected installs. Reliability depends on build, extensions, frontend and allocator layout.

Wiz Research, which credits reporters in the advisory, describes the pair as stemming from architecture decisions made over a decade ago. That is Wiz’s characterization, not the PHP project’s.

Real-World Exploitation Evidence

CISA added CVE-2026-109618 to the Known Exploited Vulnerabilities catalog on October 26, 2026, with a due date of October 29 and forensic triage marked “Yes.” The KEV entry lists ransomware campaign use as “Unknown.”

We found no evidence of named threat actors, campaigns or victim reports as of October 27, 2026 in the CISA KEV entry, the CISA alert, the PHP advisory, the oss-security thread or Wiz’s write-up. The NVD record carries a CISA SSVC entry dated October 21 with exploitation “none”; KEV listing five days later supersedes that. Wiz reports a working exploit script it calls php2shell and demonstrated RCE against WordPress, Drupal and Joomla container images; we could not confirm whether the script is public.

Impact Assessment

The advisory validated unauthenticated RCE over HTTP against mod_php with default limits and prefork configurations. Code runs with the web worker’s privileges. Expect web shells, credential theft from application config, and lateral movement from the web tier. Shared hosting and multi-site servers are exposed because one worker serves many applications.

Affected Versions

The sources conflict on the lower bound. A CrowdStrike post cited in an oss-security reply from Greenbone’s Christian Fischer says the underlying ordering behavior first shipped in 7.3.0, matching NVD. The GHSA lists no lower bound and a PHP maintainer’s oss-security reply says “PHP 8.2 before 8.2.35”. We treat the lower bound as unresolved. The CrowdStrike claim is a single vendor-blog claim. CISA’s alert says organizations that cannot update immediately, or that continue to use unsupported PHP 8.1 or earlier, should take PHP-based systems offline until they can be patched or updated. The php.net changelog lists no 8.1 fix newer than 8.1.34 (December 2025) as of October 27, 2026.

Remediation Steps

1. Inventory every PHP install, including PHP bundled in other products.
2. Upgrade to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. The advisory calls updating the only complete mitigation. The fix removes longjmp() for OOM, uses a delayed soft OOM at the next VM safe point, and a hard _exit() at a higher threshold.
3. Where you cannot patch yet, per the advisory (none is complete):
   • Set memory_limit=-1 and restart all workers. mmap() failures can still reach the longjmp() path.
   • Keep post_max_size low and limit input nesting, input variables, multipart parts and headers per part.
   • Block multipart requests at the frontend if the app does not use them.
   • Do not use RLIMIT_AS or RLIMIT_DATA.
4. Plan to replace PHP 8.1 and earlier; CISA calls them unsupported and we found no 8.1 fix in the php.net changelog as of October 27, 2026.

Detection Guidance

Wiz suggests watching for unusual multipart requests followed by memory-limit errors or repeated HTTP 500s, unexpectedly large or malformed PHPSESSID response cookies, and unexplained worker churn. CISA recommends monitoring for PHP workers launching shells or downloading tools, and has published a SIGMA rule in its SIGMA_Rules repository. No IOCs have been published in the sources we read.

Timeline

References

• GHSA-w8hw-w9fx-j79w: RCE via OOM corruption
• NVD: CVE-2026-109618
• CISA alert: Critical Vulnerabilities in PHP Require Immediate Patching
• Wiz Research: PHP2Shell
• oss-security, October 23, 2026