CVE-2026-109618

CriticalPublished

RCE via OOM corruption

Published: Oct 21, 2026
Updated: Oct 21, 2026
Assigning CNA: php
Evidence observed: Oct 21, 2026

Primary CVSS

9.2/ 10Critical

nvd · CVSS 4.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Summary

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Vulnerable Version DetectionTemplate
http/cves/2026/CVE-2026-109618.yaml
Nuclei Templates
DetectionEvidence observed: Oct 22, 2026Revision: d121a19dd2aaRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl,regex($.matchers[*].type)

php-cve-2026-10961x-lab-pocPoC
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.