‹ Back to list

CVE-2026-109618

Status: ModifiedCritical (9.2)—Exploit
Severity9.2Critical · CVSS 4.0
Exploitation probability—next 30 days
Active exploitationNonot in the CISA catalog
Public exploitAvailableProof of concept on GitHub (unverified) · Nuclei template (automated mass detection)

News and reports on Orbitaley

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVSS

Base score
9.2
Version
4.0
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploitation probability (EPSS)

FIRST hasn't scored this CVE yet (usual for very recent or rejected CVEs).

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

Media coverage

Specialised security media that have cited this CVE:

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

El vector CVSS es AV:N/PR:N/UI:N (red, sin privilegios ni interacción) y la descripción indica que la condición de OOM puede llevar a ejecución remota de código (RCE).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Affected technologies (1)

PHP — PHP

CWEs

References

Show 3 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-109618",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-109618",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-21T14:34:39.479770Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@php.net",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.2,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@php.net",
      "affectedData": [
        {
          "vendor": "PHP Group",
          "product": "PHP",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.*",
              "lessThan": "8.2.35",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "8.3.*",
              "lessThan": "8.3.36",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "8.4.*",
              "lessThan": "8.4.27",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "8.5.*",
              "lessThan": "8.5.12",
              "versionType": "semver"
            }
          ],
          "packageName": "php-src",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-21T14:17:09.357",
  "references": [
    {
      "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security@php.net"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/21/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.wiz.io/blog/php2shell-php-rce",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@php.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        },
        {
          "lang": "en",
          "value": "CWE-755"
        },
        {
          "lang": "en",
          "value": "CWE-824"
        },
        {
          "lang": "en",
          "value": "CWE-1325"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)."
    },
    {
      "lang": "es",
      "value": "PHP utiliza la función `longjmp()` para los errores de falta de memoria (OOM), con el fin de salir del contexto actual y abortar la gestión de la solicitud. Es posible que algunos contextos no tengan debidamente en cuenta esta situación y dejen la memoria de la solicitud en un estado no inicializado antes de realizar una asignación. El procedimiento posterior de limpieza de la solicitud podría leer o realizar una ramificación en esta memoria. Existen múltiples estrategias de gestión de OOM que pueden desencadenar esta condición de forma sistemática y dar lugar a la ejecución remota de código (RCE)."
    }
  ],
  "lastModified": "2026-10-22T10:09:59.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80F659BB-0C5C-4F1B-8323-AE52F32C3BE4",
              "versionEndExcluding": "8.2.35"
            },
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40BD58D9-94BD-41B6-9DDA-30CA729409FB",
              "versionEndExcluding": "8.3.36",
              "versionStartIncluding": "8.3.0"
            },
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D057202A-94FF-4118-A41F-BA8ABB76346E",
              "versionEndExcluding": "8.4.27",
              "versionStartIncluding": "8.4.0"
            },
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAF7FA75-7F87-405F-A222-C5C17D42C31F",
              "versionEndExcluding": "8.5.12",
              "versionStartIncluding": "8.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@php.net"
}