CVE-2026-109618
RCE via OOM corruption
- Severity
- 9.2CVSSv4.0
- Exploitation
- None seen No known exploitation
- EPSS
- 99.98%as of 2026-10-25
- Products
- 1no fix yet
No known exploitation, and no fixed version published yet.
An attacker who can exhaust PHP memory can turn the longjmp()-based out-of-memory path into remote code execution: multiple OOM strategies consistently leave request memory uninitialized before an allocation, and cleanup then reads or branches on it. PHP is affected; install the vendor fix from the php-src security advisory. CVSSv4.0 9.2, EPSS 0.99981 (2026-10-25), exploitation none-observed.
Synthesised from 8 public sources. Context, not the facts above. Every point is attributed to the publisher that made it.
Palo Alto Unit 42 states the flaw affects PHP core versions after v5.4, but Red Hat's page (access.redhat.com) is truncated and supplies no affected packages, fixes, or mitigations. NVD and cve.org offered no usable details either, so cross-vendor fix boundaries should be confirmed before you assume coverage.
Oracle states PHP2Shell permits unauthenticated remote code execution, no credentials required, and urges applying fixes. Full Disclosure reports both PHP2Shell CVEs, including this one, have been exploited in the wild. Treat exposure of any PHP handling unauthenticated requests as urgent, not theoretical.
Juniper describes the exploitation path: out-of-memory corruption interrupts PHP while internal request data is only partially initialized, enabling RCE; NVD attributes the root cause to longjmp() on OOM. OpenCWE classifies it as CWE-1325 and CWE-1419, repeatedly firing OOM conditions is the signal to hunt for.
What to do
No fixed version is published yet. Apply vendor mitigations or isolate the affected products.
| Product | Fixed version |
|---|---|
| PHP | none published |
Why it matters
EPSS estimates a 99.98% chance it is exploited in the next 30 days.
Scores 9.2 out of 10 (CVSSv4.0). That is remote damage without needing an account.
If you run any of the 1 products above and cannot patch today, assume it will be targeted and restrict access in the meantime.
Exploitation
- Status
- No known exploitation
- EPSS
- 99.98% chance of exploitation in 30 days · 99.98% percentile
Analysis
Public sources, summarised. This is context for your decision. The facts above are the ones to act on.
| Source | Adds | Summary |
|---|---|---|
| supportportal.juniper.net Primary | Exploit detail | Juniper advisory explaining the exploitation path: OOM corruption interrupts PHP while internal request data is only partially initialized, enabling RCE. Identifies the flaw as part of the PHP2Shell vulnerability family affecting Juniper products. |
| oracle.com Primary | Impact | Oracle's alert states PHP2Shell permits unauthenticated remote code execution, so defenders know no credentials are needed, and urges customers to apply the addressed fixes. |
| nvd.nist.gov Primary | Background | NVD description explains the root cause: PHP uses longjmp() to exit the current context on out-of-memory errors, the mechanism the flaw abuses. |
| Palo Alto Unit 42 Research 2026-10-22 | Exploit detail | Published remote exploit entry for CVE-2026-109618 stating the flaw affects PHP core versions after v5.4, giving defenders a concrete affected-version range and a working RCE reference. |
| Full Disclosure (seclists) News 2026-10-26 | Exploit detail | Reports that both PHP2Shell CVEs (CVE-2026-109618 and CVE-2026-109619) have been successfully exploited in the wild, confirming active attacks rather than theoretical risk. |
| app.opencve.io News | Background | Provides the CWE classifications for this CVE: CWE-1325 (Improperly Controlled Sequential Memory Allocation) and CWE-1419 (Incorrect Initialization), linking the bug to memory-allocation and initialization defects, but offers no patch or mitigation. |
| github.com Source | — | TheCyberGeek/php2shell-research |
| calif.io Source | — | PHP2Shell by Calif Research |
Vendor references
Published
Not recorded for this entry