CVE-2026-109618: PHP2Shell Out-of-Memory Flaw, Advisory Summary and Fix

As of 23 October 2026, CVE-2026-109618 is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, it is not on CISA's Known Exploited Vulnerabilities list, and exploitation attempts are widely reported while no confirmed successful compromise has been publicly documented. CVE-2026-109618 is one of the two PHP engine flaws known as PHP2Shell. The PHP project calls it "RCE via OOM corruption": a problem in how PHP handles running out of memory (OOM) that can let an attacker who never logs in run code on an unpatched server.

The fix is to install a fixed PHP release, or your Linux distribution's patched package, and then restart every PHP worker. Temporary php.ini settings exist, but PHP says they "do not make an installation safe." This defender's summary for IT staff and developers does not cover how the flaw is triggered; for the plain-English overview, see what PHP2Shell is.

What PHP Says About CVE-2026-109618

The PHP project's 21 October 2026 announcement gives this one-sentence description: "out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid."

The GitHub advisory lists five weakness types (CWEs): CWE-416 Use After Free, CWE-755 Improper Handling of Exceptional Conditions, CWE-824 Access of Uninitialized Pointer, CWE-1325 Improperly Controlled Sequential Memory Allocation and CWE-1419 Incorrect Initialization of Resource. In plain terms, PHP can be left holding half-built data after a memory failure and then use it as if it were valid.

How Severe Is It?

PHP's vector is CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. It marks the flaw as network-reachable with no privileges or user interaction, but with high attack complexity. On FIRST's CVSS 4.0 scale, 9.0 to 10.0 is critical.

The scorers use different CVSS versions, so the numbers are not directly comparable. The 10.0 that circulated before release was, per the PHP Foundation, "a wrong CVSS score."

Who Is at Risk

PHP's announcement lists "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed."

• Apache with mod_php: highest risk. PHP says there is "a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs." The GitHub advisory adds that complete remote code execution was validated "against mod_php with default PHP input and memory limits."
• PHP-FPM: the advisory says "Source analysis therefore supports FPM as a susceptible, though no complete FPM exploit has been demonstrated for this SAPI." Treat FPM servers as exposed.
• FrankenPHP and LiteSpeed: the advisory calls FrankenPHP "likely susceptible to application-independent attacks" and says LiteSpeed's LSAPI "models FPM."

A login page, security plugin or CMS update does not change your exposure; the fix has to happen in the PHP runtime. Platform-specific notes are in our PHP2Shell and WordPress guide.

Affected and Fixed Versions

PHP lists only supported branches; Wiz, Calif and watchTowr say older versions, back to PHP 5.4, are affected. On an old branch, assume exposure. The full branch-by-branch list, with distribution packages, is in our PHP2Shell fixed versions table.

Distribution patches keep the old version number

Linux distributions usually backport the fix into the version they already ship. AlmaLinux says: "Don't rely on php -v: our fixes are backported, so the upstream PHP version number doesn't change." Examples:

• Ubuntu 24.04 LTS: php8.3 8.3.6-0ubuntu0.24.04.13 (reports PHP 8.3.6, but is patched).
• RHEL 10: php 8.3.36-1.el10_2 (RHSA-2026:87070).

Check your distribution's security notice or package changelog, or ask your host in writing. Also note that the command-line php -v can report a different PHP from the one your web server runs. For a repeatable routine, see our security patching best practices.

Official Interim Settings for CVE-2026-109618

PHP frames these as follows: "while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe." The settings for this CVE, quoted exactly from php.net:

1. "Set memory_limit=-1, preferably in a way applications can't override, such as php_admin_value in the FPM pool or Apache configuration, and check that no pool, directory or application setting puts a finite limit back. This removes the controllable PHP memory limit failure, but an underlying allocation failure can still reach the vulnerable path."
2. "Set a low post_max_size. For applications that don't require file uploads, set post_max_size = 8M. If file uploads are necessary, set post_max_size = 32M. Keep upload_max_filesize below post_max_size."
3. "Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length."
4. "Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not substitute RLIMIT_AS or RLIMIT_DATA, as these can cause the vulnerable allocation failure."

The GitHub advisory adds: "If the application does not use multipart form data, block such requests at the frontend before they reach PHP."

Caveats and side effects

Set these in php.ini, the FPM pool or the server configuration, not from application code. CVE-2026-109619 has its own separate settings; the advisory says to "also follow the remediation advice from the related report." Every setting for both CVEs is explained in our PHP2Shell interim mitigations guide.

Restart Every PHP Worker

A fixed package on disk does nothing until running PHP processes are replaced. The advisory says: "Restart every PHP worker and confirm that no pool, directory or application setting restores a finite PHP memory limit." Examples for Debian or Ubuntu (replace 8.3 with your version):

sudo systemctl restart php8.3-fpm
sudo systemctl restart apache2

Also restart long-running PHP workers and redeploy containers on a fixed image. On hosted plans, ask your host to confirm.

Detection Signs

No official indicators of compromise have been published. Vendors describe behavior to look for, starting no later than 17 October 2026, the date of the earliest attempt Amazon reported:

• Wiz: "unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses" and "unexplained PHP worker churn."
• Sophos: "spikes in memory-exhaustion errors or worker crashes (segmentation faults)" and "newly created or modified PHP files that may indicate web shells."
• Datadog: memory-exhaustion errors during request initialization, logged "in Unknown on line 0", and Apache "Segmentation fault (11)" messages.
• CISA: "PHP worker processes launching shells or downloading tools."

Bitdefender notes: "A successful exploit can return HTTP 200 and leave the worker running. Crash logs measure attempts, not compromises." If you see these signs, follow our PHP2Shell compromise check and the first-hour incident response plan.

Timeline and Primary Sources

Primary sources: the php.net 21 October announcement, GitHub advisory GHSA-w8hw-w9fx-j79w, the PHP 8 ChangeLog and the NVD entry. Live exploitation reports are on our PHP2Shell exploitation status page.

Conclusion

As of 23 October 2026, CVE-2026-109618 is a critical, login-free flaw in PHP's out-of-memory handling with a fix available for every supported branch. Install a fixed release or patched package, restart every worker, and use the interim settings only as a stopgap. If you need hands-on help, our emergency PHP patching team can work with your host or server. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions