CVE-2026-109618 is a memory-safety vulnerability in how PHP handles out-of-memory errors that can allow an unauthenticated remote attacker to run code on the server. It is one of two vulnerabilities disclosed as PHP2Shell.

When PHP runs out of memory while processing a request, it can stop partway through setting up internal request data. The cleanup that follows may then treat that incomplete data as valid. An attacker can trigger this condition on purpose with crafted requests.

About PHP2Shell:

 PHP2Shell is the name Wiz Research gave to a set of memory-safety flaws in the core PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619. Both stem from how PHP cleans up after a request ends unexpectedly, such as when it runs out of memory. Because the flaws are in PHP itself, a website can be vulnerable even if its own code is secure. Researchers demonstrated unauthenticated remote code execution on WordPress, Drupal, and Joomla, as well as reading sensitive data such as passwords and API keys from server memory.

Impact

An unauthenticated attacker can send crafted requests that run code on the server, giving them control of the website and access to its data. Any website running on an affected PHP version is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed deployments. PHP considers mod_php the highest risk because an unauthenticated request can trigger the attack before any application code runs. Security researchers have observed exploitation attempts against both PHP2Shell vulnerabilities in the wild since October 21, 2026. Neither vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog yet.

Remediation:

Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or install the patched package from your Linux distribution or hosting provider. PHP 8.1 and earlier no longer receive official updates, so upgrade to a supported version or contact your vendor for backported fixes. If you cannot update right away, PHP recommends setting memory_limit=-1 in server-level configuration that applications cannot override, and lowering post_max_size. These steps reduce exposure but do not make the server safe.