CVE-2026-109618: RCE via Out-of-Memory Condition

In short: CVE-2026-109618 is one of the two vulnerabilities behind PHP2Shell. An out-of-memory condition can interrupt PHP while request data is only partly initialised; during cleanup, invalid data can then be treated as valid. This enables code execution without logging in. The flaw is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

What is CVE-2026-109618?

CVE-2026-109618 (GitHub identifier GHSA-w8hw-w9fx-j79w) is a memory-error vulnerability in the core of PHP. It is rated 9.2 on CVSS v4.0. Together with CVE-2026-109619, it forms what the media call PHP2Shell.

The effect is a so-called unauthenticated remote code execution: an attacker can execute code on the web server remotely and without a user account. This puts the vulnerability in the most dangerous class of weaknesses a web server can have.

How the vulnerability arises in principle

When PHP processes a web request, it creates internal data structures for that request, for example for submitted form data. If PHP runs into its memory limit in the process, it aborts with an out-of-memory condition. According to php.net, this can happen while the request data is only partly initialised.

At the end of every request, PHP cleans up and frees the memory. That is exactly where the flaw lies: the cleanup can treat invalid, only half-created data as valid. Under certain conditions, code execution can be derived from this faulty behavior.

Why is such a flaw so serious? A memory error in the programming language affects all applications running on it, regardless of how carefully they are programmed. A well-maintained WordPress installation with current plugins is just as affected as an old custom development. That is why an update of the application does not help here, only an update of PHP.

We deliberately do not publish further technical details on exploitation. They are not needed for defense: what matters is whether your server uses a fixed version and whether the new processes are actually running.

Affected versions and operating modes

The operating modes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are affected. The PHP team rates the risk highest for mod_php. Distributions and hosting providers sometimes apply backports, so an older version number is displayed although the flaw is fixed. What counts is the package version and the provider's confirmation.

For scale: Palo Alto Networks (Unit 42) counted more than 22.6 million exposed, potentially vulnerable instances. The BSI declared warning level 3 (orange) and expected rapid large-scale exploitation.

Fixing CVE-2026-109618: update and restart

The only complete remedy is the update. First check the version and package version. Package names differ by distribution; the examples assume PHP 8.3:

php -v
apt policy php8.3-fpm          # Debian/Ubuntu
dnf info php-fpm               # RHEL, AlmaLinux, Rocky, Fedora
rpm -q --changelog php-fpm | grep -i "CVE-2026-109618"

If the package changelog names the CVE number, the backport has been applied. If it is missing, that does not automatically mean the package is vulnerable; in that case, compare against the version table or ask the provider.

After the update, all PHP processes must be restarted, for example with systemctl restart php8.3-fpm or, with mod_php, by restarting Apache. How to make sure that no old worker is still running is described at Restarting PHP-FPM and all workers.

Interim measures if the update is not yet possible

php.net has published interim measures for PHP2Shell. They apply to both vulnerabilities together and are explicitly not full protection. That several of them relate to memory limits fits the out-of-memory trigger of CVE-2026-109618; there is, however, no official assignment of individual measures to individual CVEs.

; example FPM pool, e.g. /etc/php/8.3/fpm/pool.d/www.conf (path varies by distribution)
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 8M          ; 32M if uploads are needed
php_admin_value[upload_max_filesize] = 6M    ; immer unter post_max_size
php_admin_flag[session.upload_progress.enabled] = off

The values must be set so that applications cannot override them, hence php_admin_value. With memory_limit=-1, the service needs an external memory limit, via container or cgroup, not via RLIMIT_AS or RLIMIT_DATA. On PHP 8.5, fatal_error_backtraces=0 is added. All details are at Immediate measures if you cannot patch yet.

How does PHP SOS help?

Through our PHP patch service, we close CVE-2026-109618 in a structured way:

• Record the current state: PHP branch, operating mode, package source and backport status per server.
• Install the update from the appropriate package source or, where that is not possible, set the interim measures cleanly in the pool or server configuration.
• Check the restart: We verify that no old PHP processes are running any more.
• Record: You receive documentation with versions and package states before and after the intervention, for example for management, insurers or data protection.

Frequently asked questions

Sources

• php.net: Security announcements
• PHP 8 ChangeLog
• BSI: German Federal Office for Information Security