CVE-2026-109618
9.8CriticalPublished 21 Oct 2026 · NVD status: Modified · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-416, CWE-755, CWE-824, CWE-1325
Impact
Unauthenticated remote attackers can execute arbitrary code on the server hosting PHP. They only need network access to send requests that trigger out-of-memory errors.
Root cause
PHP's OOM handling uses longjmp() which aborts request execution and leaves request memory uninitialized, causing subsequent cleanup routines to read or branch on uninitialized or freed pointers.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade PHP to the patched release specified in the upstream vendor advisory; interim mitigations are not specified in the CVE data.
$ php -vAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
References
- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79wMitigationVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/6
- https://www.wiz.io/blog/php2shell-php-rceThird Party Advisory