Details
- Type
- Remote Code Execution
- Impact
- Remote Code Execution
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published
- 21 October 2026
- Updated
- 23 October 2026
- Weakness
- CWE-416
Vendor fix
Update to the latest PHP version with out-of-memory handling fixes.
Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-109618
- http://www.openwall.com/lists/oss-security/2026/10/21/6
- https://www.php.net/index.php#2026-10-21-5
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/
- https://previdian.com/CVE-2026-109618
- https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
- https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618
- https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619
- https://www.wiz.io/blog/php2shell-php-rce
- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- https://github.com/projectdiscovery/nuclei-templates/pull/17461
- https://github.com/assetnote/php2shell-scanner
- https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-109618&date=2026-10-23
- https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/