CVE-2026-109618: the PHP2Shell out-of-memory flaw

CVE-2026-109618 at a glance

Nickname	PHP2Shell (with CVE-2026-109619)
Component	PHP core runtime (request handling)
Type	Remote code execution after an out-of-memory condition
Severity	CVSS v4.0 9.2 — Critical
Login required?	No — unauthenticated, remote
Affected	PHP 5.4 through 8.5.11 serving web requests
Fixed in	8.5.12, 8.4.27, 8.3.36, 8.2.35
Advisory	GHSA-w8hw-w9fx-j79w
Exploited?	Exploitation attempts reported in the wild

What does CVE-2026-109618 do?

When PHP starts handling a web request it builds internal structures for the incoming data. CVE-2026-109618 is triggered when PHP hits an out-of-memory error during one of those vulnerable operations. The error leaves request data partially initialised, and cleanup code that runs afterwards treats that broken state as if it were valid.

Researchers showed that an attacker who can steer the process into that situation with a crafted request can turn the corruption into remote code execution on the server. The same family of techniques was also used to disclose live worker memory, which can contain other users’ passwords, API keys and session tokens.

We deliberately don’t describe how to trigger the bug. Everything on this site is for defenders.

Which servers are affected?

Any PHP installation that serves web requests, including:

• Apache with mod_php — the highest-risk setup, because the attack fires before your application code runs.
• PHP-FPM with Nginx, Apache or Caddy. PHP-FPM’s startup behaviour blocks one specific out-of-memory path, but the PHP project still says it must be patched.
• php-cgi, FrankenPHP and LiteSpeed.

The command-line interpreter on its own (scripts, cron jobs, queue workers that don’t accept HTTP) is not the main concern — but it’s usually the same package, so it gets upgraded at the same time.

How is it different from CVE-2026-109619?

Both bugs are memory-safety problems in PHP’s request handling and both lead to code execution:

• CVE-2026-109618 is about what happens after an out-of-memory error: half-built request data gets processed by cleanup code.
• CVE-2026-109619 is about stale state between requests: references to freed request data survive and a later request on the same worker can reach them.

The same PHP releases fix both, so you don’t need to treat them separately.

How do I fix CVE-2026-109618?

1. Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 — or install your distribution’s patched package. Guides: Ubuntu & Debian, RHEL family, Docker, cPanel.
2. Restart PHP-FPM, Apache or LiteSpeed so no old worker keeps running the vulnerable code.
3. Verify the running version, not just the installed package. How to check.
4. Review for compromise, because exploitation started before disclosure. Checklist.

If you run PHP 8.1 or older there is no official binary release with the fix — see your upgrade options.

Can I mitigate it without patching?

Only partly. Enforcing strict request-size limits at the web server or proxy, keeping WAF rules on and restricting public access reduce exposure while you schedule the upgrade. They don’t remove the bug. See interim mitigations.

Don’t use resource limits as a fix. A PHP core developer warned against relying on RLIMIT_AS or RLIMIT_DATA as a substitute for patching.

How can I tell if I’m vulnerable?

• Quick check: paste your version into the checker on our home page.
• Accurate check: on the server, run npx php2shell-checker@latest --local --php /path/to/php-fpm. It reads the version of the binary you point it at and never sends attack traffic.
• Distribution packages: look up CVE-2026-109618 in your vendor’s tracker (linked below) or grep your package changelog — a backported fix may keep an older version number. Here’s how.

Signs it may have been exploited

The PHP2Shell reports describe a recognisable pattern: unusual multipart requests followed by memory-limit errors or bursts of HTTP 500 responses, unusually large PHPSESSID cookies, and unexplained PHP worker restarts. Our compromise checklist shows how to search your logs for each one.