CVE-2026-109618 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-21

Added to CISA KEV: 2026-10-26 5 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

IMMEDIATE (P0): Patch PHP to fixed versions NOW — update PHP 8.2.x to ≥8.2.35, PHP 8.3.x to ≥8.3.36, PHP 8.4.x to ≥8.4.27, PHP 8.5.x to ≥8.5.12. This is a critical RCE vulnerability with active exploitation and public PoC.
INCIDENT RESPONSE: Treat all unpatched internet-facing PHP servers as potentially compromised. Review web server access logs for anomalous requests, especially those triggering memory allocation failures or generating OOM-related error logs around and after the CVE publication date (2026-10-21).
INDICATORS OF COMPROMISE: Check for unexpected new files in web root directories, new cron jobs, new user accounts, unauthorized SSH keys, reverse shell connections, unusual outbound network connections from web server processes, and signs of post-exploitation activity (web shells, backdoors).
TEMPORARY MITIGATION (if patching is delayed): Deploy WAF rules to detect and block OOM-triggering request patterns as described in the GitHub Security Advisory (GHSA-w8hw-w9fx-j79w). Implement memory limits and resource controls at the OS/container level. Consider taking internet-facing PHP applications offline until patched if the risk profile permits.
DETECTION: Monitor for unusual memory exhaustion patterns in PHP error logs (OOM errors), anomalous child process spawning from web server processes, unexpected file writes by the web server user, and outbound connections from PHP processes.
SIEMENS RUGGEDCOM: If operating RUGGEDCOM APE1808 devices, apply Siemens security advisory SSA-566512 patches immediately and review device logs for signs of compromise.
INVENTORY: Audit all PHP installations across your environment including containerized workloads, CI/CD pipelines with PHP, and any embedded appliances — the Siemens advisory demonstrates this vulnerability propagates into device firmware.
PATCH PRIORITY: CRITICAL — treat as emergency patch, equivalent to Log4Shell or similar mass-exploitation events. Do not wait for standard patch cycles.

🔍 Web Intelligence (Kagi · 2026-10-26)

Summary

CVE-2026-109618 is a critical remote code execution (RCE) vulnerability in the PHP scripting language, collectively referred to alongside CVE-2026-109619 as "PHP2Shell." The flaw arises because PHP’s use of `longjmp()` to handle out-of-memory (OOM) errors fails to properly manage request memory, leaving it in an uninitialized or corrupted state before subsequent allocations occur. This vulnerability is highly significant because it affects nearly all PHP deployments, including those using PHP-FPM, Apache `mod_php`, `php-cgi`, FrankenPHP, and LiteSpeed, potentially allowing unauthenticated attackers to achieve full system compromise.

Exploitation

Active Exploitation: The vulnerability is being actively exploited in the wild, with reports indicating it is a primary vector for unauthenticated RCE across internet-facing web servers.
Threat Actors: While specific campaigns are evolving, security researchers have observed rapid integration of PHP2Shell exploits into automated scanning and mass-exploitation botnets.
Proof-of-Concept: Publicly available exploit scripts and proofs-of-concept exist, enabling attackers to trigger the OOM condition reliably to facilitate RCE.
Attack Prerequisites:

- Network Access: Remote (internet-facing). - Authentication: None required (unauthenticated). - User Interaction: None required.

Affected Products & Patches

Affected Versions: All PHP installations serving web requests are potentially affected. The risk is considered highest for configurations using `mod_php` due to its persistent memory handling patterns.
Patch Availability: The PHP Security Team has released urgent updates to address these vulnerabilities; system administrators are advised to update their PHP installations to the latest patched versions immediately.
Mitigations: In environments where immediate patching is not possible, organizations should implement Web Application Firewall (WAF) rules designed to detect and block malicious OOM-triggering requests and limit exposed server memory, though patching remains the only definitive remediation.

Impact

Successful Exploitation: Allows unauthenticated attackers to execute arbitrary code with the privileges of the web server user, leading to full system control, data exfiltration, or the installation of persistent backdoors.
Business Risk: For internet-facing deployments, this vulnerability poses an extreme business risk, as it allows for trivial and large-scale compromise of web applications, potentially leading to widespread ransomware deployment, unauthorized access to sensitive databases, and complete service outages.