CVE-2026-109618: Remote Code Execution in PHP Core via Out-of-Memory longjmp() Uninitialized Memory Access

Vulnerability ID: CVE-2026-109618

CVSS Score: 9.8

Published: 2026-10-21

CVE-2026-109618 (dubbed PHP2Shell) is a critical vulnerability in the PHP engine core resulting from improper out-of-memory exception handling via longjmp(). When request allocation fails mid-processing, non-local control flow bypasses cleanup procedures, leaving memory structures uninitialized or in a use-after-free state during request shutdown.

TL;DR

Unauthenticated remote attackers can trigger an out-of-memory error during PHP request processing, causing non-local longjmp() unwinding that leaves memory structures uninitialized and results in arbitrary code execution during request shutdown.

Technical Details

CWE ID : CWE-416 / CWE-824

Attack Vector : Network (Unauthenticated)

CVSS v3.1 Score : 9.8 (Critical)

CVSS v4.0 Score : 9.2 (Critical)

EPSS Score : 0.05307 (92.56th percentile)

Impact : Remote Code Execution…