PHP: Remote code execution via out-of-memory corruption
Deadline for US federal agencies: 29 Oct 2026
Summary
PHP versions 8.2 to 8.5 before the October 2026 releases contain a flaw in out-of-memory handling. When a request runs out of memory, PHP aborts it with longjmp() while request memory is still incomplete, and request shutdown then reads or branches on this invalid state. An unauthenticated remote attacker can send crafted HTTP requests, such as oversized multipart uploads, to achieve remote code execution as the web server account. Apache mod_php is confirmed exploitable with default settings, while FPM is considered susceptible but no complete FPM exploit has been shown.
Affected
- PHP 8.2.x before 8.2.35
- PHP 8.3.x before 8.3.36
- PHP 8.4.x before 8.4.27
- PHP 8.5.x before 8.5.12
- PHP 8.1 and older: affected, no upstream fix. Distribution backports may exist.
- Exact fixed package versions for distributions and appliances: Unknown.
Fixed in
- PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12, or a later release in the same branch
- Distribution packages: Unknown, check the vendor advisory
Workaround
- Updating is the only complete mitigation.
- Interim only, not a complete fix: set memory_limit=-1 administratively and restart all PHP workers. This needs a risk decision.
- Limit post_max_size, the decoded request size, multipart parts, headers per part and uploads at the frontend.
- If the application does not use multipart form data, block such requests before they reach PHP.
- Do not use RLIMIT_AS or RLIMIT_DATA.
Exploitation
- Public proof-of-concept code is circulating. watchTowr reproduced the issue.
- CISA lists the CVE as known exploited (added 2026-10-26). The CISA SSVC assessment states active exploitation.
- Palo Alto Networks reports active exploitation against internet-exposed PAN-OS management interfaces. This is a vendor claim and its scope is not verified.
Our recommendation
- Identify all PHP installations, including PHP bundled in appliances and CMS stacks, and check their versions.
- Update PHP to the fixed versions above or to a distribution package with a backport. Prioritise internet-facing hosts and PHP 8.1 and older.
- Restart all PHP workers after the update.
- Until patched, apply the interim measures and monitor web server logs for unusual multipart requests and worker crashes.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (25 repositories)
corelight/php2shell-detect · zhaoboy9692/CVE-2026-109618 · zhaoboy9692/CVE-2026-109618_ · 0ldbaby/php2shell · mikensec/php2shell-lab - Exploit-DB EDB-ID 52704 – PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE 22 Oct 2026
Research sources
- GitHub Security Advisory GHSA-w8hw-w9fx-j79w github.com
- oss-security announcement by the PHP security team www.openwall.com
- CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
- CERT-EU security advisory 2026-018 cert.europa.eu
- Palo Alto Networks Unit 42 analysis unit42.paloaltonetworks.com
- AlmaLinux advisory on PHP packages almalinux.org
- NCSC-NL php2shell wiki github.com
- Wiz analysis of php2shell www.wiz.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:33.
Original description (NVD)
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
NVD references (11)
- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- http://seclists.org/fulldisclosure/2026/Oct/51
- http://www.openwall.com/lists/oss-security/2026/10/21/6
- http://www.openwall.com/lists/oss-security/2026/10/23/5
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-co…
- https://cert-portal.siemens.com/productcert/html/ssa-166980.html
- https://cert-portal.siemens.com/productcert/html/ssa-566435.html
- https://cert-portal.siemens.com/productcert/html/ssa-566512.html
- https://php2shell.delftintellab.com
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618
- https://www.wiz.io/blog/php2shell-php-rce
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.