---
id: CVE-2026-109618
title: RCE via OOM corruption
summary: >-
  PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context
  and abort handling of the request. Some contexts may not properly account for
  this scenario and leave request memory in an uninitialized state before
  performin…
severity: critical
cvss: 9.2
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-416
  - CWE-755
  - CWE-824
  - CWE-1325
  - CWE-1419
vendor: PHP Group
product: php-src
affected:
  - php-src >= 8.2.* < 8.2.35
  - php-src >= 8.3.* < 8.3.36
  - php-src >= 8.4.* < 8.4.27
  - php-src >= 8.5.* < 8.5.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-21T14:34:39.479770Z'
exploitAvailable: true
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T16:07:52.535Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109618'
references:
  - url: 'https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w'
tags:
  - cve.org
  - exploit-available
exploits:
  github: 73
  githubRepos:
    - 'https://github.com/ikow/php2shell-poc'
    - 'https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC'
    - 'https://github.com/Zer061/CVE-2026-109618'
  checkedAt: '2026-10-21T17:07:54.352Z'
ingestedAt: '2026-10-21T13:57:01.110Z'
---

## Overview

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

## Affected

- `php-src >= 8.2.* < 8.2.35`
- `php-src >= 8.3.* < 8.3.36`
- `php-src >= 8.4.* < 8.4.27`
- `php-src >= 8.5.* < 8.5.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Check the GitHub Security Advisory for mitigation strategies.