CVE-2026-109618: PHP Memory Handling RCE Vulnerability

CVE-2026-109618 Overview

CVE-2026-109618 is a critical remote code execution vulnerability in PHP caused by improper handling of out-of-memory (OOM) conditions. PHP uses longjmp() to abort request handling when OOM errors occur. Some contexts fail to properly reset request memory before performing subsequent allocations. The cleanup procedure then reads or branches on uninitialized memory, which attackers can shape through controlled OOM strategies. The condition is classified as a use-after-free weakness [CWE-416] and can be triggered consistently to achieve code execution on vulnerable PHP servers.

Critical Impact
Unauthenticated attackers can trigger memory corruption via network-reachable PHP endpoints and execute arbitrary code in the context of the PHP process.

Affected Products

PHP (upstream php-src)
PHP-FPM deployments exposing request handling to untrusted input
Web applications running vulnerable PHP interpreter versions tracked under php:php

Discovery Timeline

2026-10-21 - CVE CVE-2026-109618 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-109618

Vulnerability Analysis

The flaw lives in PHP's request lifecycle. When the Zend memory manager cannot satisfy an allocation, it calls longjmp() to abandon the current execution frame and return control to the request shutdown path. This non-local jump bypasses normal cleanup routines that would otherwise initialize per-request state. Several internal contexts allocate memory before marking associated structures as valid. If the allocation fails, the structures remain in an uninitialized state, yet later shutdown code still reads pointers or branches on fields within them. Attackers who can force deterministic OOM conditions can control the stale data left behind and redirect execution flow during cleanup.

Root Cause

The root cause is a use-after-free and uninitialized memory read pattern [CWE-416] induced by longjmp()-based error recovery. PHP's internal allocator abandons the active context without resetting pointers that downstream request teardown logic trusts to be valid.

Attack Vector

Exploitation is network-based and requires no authentication. An attacker sends crafted HTTP requests to a PHP endpoint that drive the interpreter into OOM states through large allocations, oversized inputs, or recursive structures. By repeating this pattern, the attacker places controlled bytes into memory regions later consumed by request cleanup, achieving remote code execution.

bash

# Public proof-of-concept usage (eness/php2shell PoC repository)

# Default command execution against target URL
python3 poc_109618.py -u http://127.0.0.1:8088/index.php

# Execute a custom command (max 14 bytes) and verify via local proof file
python3 poc_109618.py -u http://127.0.0.1:8088/index.php -c 'id>/out/p1' --proof-file out/p1

# Execute command writing to webroot and verify via HTTP GET fetch
python3 poc_109618.py -u http://127.0.0.1:8088/index.php -c 'id>p1.txt' --fetch /p1.txt

Source: eness/php2shell PoC repository

Detection Methods for CVE-2026-109618

Indicators of Compromise

Repeated HTTP requests with abnormally large payloads, deeply nested parameters, or oversized headers targeting PHP endpoints.
PHP-FPM or Apache worker processes crashing with segmentation faults or memory allocation failures followed by respawns.
Unexpected child processes spawned by the PHP interpreter such as sh, bash, or python executing reconnaissance commands like id or uname.
New files written under the web root shortly after bursts of failing requests, consistent with the public PoC's --fetch verification step.

Detection Strategies

Monitor web access logs for request bursts producing HTTP 500 responses or truncated responses correlated with worker restarts.
Enable PHP error logging and alert on Allowed memory size exhausted entries occurring in tight clusters from the same source.
Use endpoint detection to flag php-fpm, httpd, or nginx worker processes executing shell binaries or writing to web-served directories.

Monitoring Recommendations

Baseline normal request body sizes and alert on statistical outliers reaching PHP handlers.
Forward PHP-FPM and web server error logs into a centralized SIEM for correlation with process execution telemetry.
Track outbound network connections initiated by PHP worker processes, which should rarely occur in typical web application deployments.

How to Mitigate CVE-2026-109618

Immediate Actions Required

Apply the upstream PHP security patch referenced in the PHP GitHub Security Advisory GHSA-w8hw-w9fx-j79w as soon as vendor packages are available.
Inventory all internet-exposed PHP services, including PHP-FPM pools behind reverse proxies, and prioritize patching those first.
Restrict memory_limit and post_max_size in php.ini to constrain OOM-triggering payload sizes.
Deploy web application firewall rules to drop oversized request bodies and deeply nested parameter structures.

Patch Information

Refer to the PHP GitHub Security Advisory GHSA-w8hw-w9fx-j79w and the OpenWall OSS-Security announcement for the authoritative list of fixed versions. Additional technical analysis is available in the Wiz Blog PHP RCE analysis.

Workarounds

Lower memory_limit per PHP-FPM pool so attacker-induced OOM conditions are harder to shape reliably.
Place strict request size and rate limits in front of PHP endpoints using a reverse proxy or WAF.
Isolate PHP workers using mandatory access controls such as SELinux or AppArmor to limit the impact of successful exploitation.
Disable unused PHP SAPIs and modules to reduce the attack surface available during request cleanup.