CVE-2026-109618: PHP Out-of-Memory Corruption RCE ("php2shell")

CVE-2026-109618 ("php2shell") is an out-of-memory memory-corruption flaw in PHP's request-shutdown handling that lets a remote, unauthenticated attacker execute arbitrary code as the web worker account on any PHP deployment that handles requests — Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are all named — and CISA added it to the KEV catalog one day before its three-day remediation deadline because it is already being exploited.

CVE-2026-109618 (CWE-416/CWE-824, part of a CWE cluster including CWE-755, CWE-1325 and CWE-1419) is a memory-corruption vulnerability in PHP's handling of out-of-memory (OOM) errors. PHP uses longjmp() to abort the current request when an allocation fails, but in some contexts request memory is reachable before it is fully initialized; if an allocation fails at that point, PHP does not properly account for the early exit and leaves that memory in an invalid state, which the request-shutdown procedure then reads or branches on (NVD).

The PHP project's own security advisory describes several ways an attacker can reliably trigger an OOM at the vulnerable point while staying within normal post_max_size/memory_limit configuration — for example, a multipart request without a usable declared content length, a multipart part with an unbounded number of headers, or deeply nested field names that multiply array-building work — and states that "[m]ultiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)" (PHP Security Advisory GHSA-w8hw-w9fx-j79w).

NVD's own analysis gives CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, unauthenticated, full impact to confidentiality, integrity and availability. The PHP project's own CVSS v4.0 submission is lower at 9.2 (critical), reflecting the v4.0 metric's attack-requirements factor, but both scores agree the flaw is remotely exploitable without authentication (NVD).

CISA's alert on this and the companion CVE-2026-109619 states the pair affects "all PHP installations that process web requests, including (but not limited to) deployments using Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed," and that confirmed exploitation has reached unauthenticated remote code execution as the web worker account, notably against Apache mod_php in its default configuration. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; organizations that cannot patch immediately are told to take PHP 8.1-or-earlier unsupported installations offline (CISA Alert: Critical Vulnerabilities in PHP Require Immediate Patching).

CISA added CVE-2026-109618 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-26, with a required-action due date of 2026-10-29 and a "Forensics Triage Requirements" flag under BOD 26-04; known ransomware-campaign use is recorded as "Unknown" as of that date (CISA KEV).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.99981 (99.981th percentile) — among the highest EPSS scores tracked, consistent with CISA's description of ongoing exploitation (FIRST EPSS).

Because this is unauthenticated, pre-auth remote code execution affecting almost every PHP deployment pattern, any internet-facing PHP install on an affected branch should be updated to the fixed release immediately, or taken offline if it is already end-of-life.

• Out-of-memory handling leaves request memory in an invalid state that the shutdown procedure reads or branches on, enabling memory corruption. — NVD
• Multiple attacker-controllable OOM strategies (multipart parsing edge cases) can consistently trigger the condition and lead to RCE; fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12. — PHP Security Advisory GHSA-w8hw-w9fx-j79w
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, per NVD's own analysis. — NVD
• Affects all PHP deployments handling web requests (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed); confirmed unauthenticated RCE exploitation, notably against Apache mod_php default configs. — CISA Alert: Critical Vulnerabilities in PHP Require Immediate Patching
• Added to the CISA KEV catalog on 2026-10-26, due date 2026-10-29, with a forensics-triage requirement under BOD 26-04. — CISA KEV
• EPSS score is 0.99981 (99.981th percentile) as of 2026-10-26. — FIRST EPSS