CVE-2026-109618 · GHSA-w8hw-w9fx-j79w
The out-of-memory half of PHP2Shell: an attacker pushes PHP into an out-of-memory error while it parses a request, leaving half-initialised data that PHP later trusts. Result: unauthenticated code execution as the web-server user.
Last reviewed 2026-10-22
Severity
Authentication
Fixed in
Part of
PHP aborts the current context with longjmp() when it runs out of memory. If that happens while request memory is only partly initialised, request shutdown later reads or branches on invalid data. Several multipart-parsing paths can push PHP into OOM within normal limits, before any application code runs.
Impact: Unauthenticated code execution as the PHP web-worker user. Demonstrated: Pre-auth RCE on WordPress, Drupal and Joomla (mod_php, default limits).
PHP handles running out of memory by raising a fatal error and jumping out of the current code path with longjmp(). Anything that was half-built at that moment stays half-built.
If request memory had been allocated but not yet initialised, request shutdown later reads or branches on that invalid data. Several multipart (file-upload form) parsing paths can drive PHP into out-of-memory within normal limits, which is why no application code needs to be involved.
Weaknesses listed by PHP: use-after-free (CWE-416), improper handling of exceptional conditions (CWE-755), access of uninitialised pointer (CWE-824) and related state-handling CWEs.
Upload-progress unserializer use-after-free
Upload-progress handling decodes session data before request initialisation finishes. An allocation failure frees the request heap but leaves the unserializer bookkeeping global set; the next request on the worker treats attacker-reclaimed memory as live state.
Remote memory disclosure via PHPSESSID
After an OOM abort a session-ID pointer dangles. A later multipart request URL-encodes whatever memory it now points to into the PHPSESSID response cookie — even if the app never starts a session.
The PHP advisory and the Wiz write-up group some paths differently. The patch fixes the shared failure pattern, so the grouping does not change what you need to do.
| Branch | Vulnerable | Fixed in |
|---|---|---|
| 8.5 | < 8.5.12 | 8.5.12 |
| 8.4 | < 8.4.27 | 8.4.27 |
| 8.3 | < 8.3.36 | 8.3.36 |
| 8.2 | < 8.2.35 | 8.2.35 |
| 8.1 · 8.0 · 7.4 | all | Source backport only |
| 5.4 – 7.3 | all | No fix |
| Setup | …109618 | Notes |
|---|---|---|
| Apache + mod_php | RCE confirmed | Both CVEs validated to RCE with default limits. Highest-risk setup. |
| PHP-FPM (nginx, Apache, Caddy…) | Susceptible | Session-lifecycle RCE validated on FPM. OOM path confirmed through application-level code paths; no generic FPM exploit published. |
| FrankenPHP / LiteSpeed LSAPI | Likely | Advisory rates them likely susceptible. Long-lived workers make cross-request state more relevant, not less. |
| CLI (cron, queue workers, artisan) | Not covered | Not discussed by the advisories and not reachable by HTTP requests in normal use. Upgrade anyway — it is the same package. |
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
| Metric | Meaning here | Effect |
|---|---|---|
AV:N Attack Vector: Network | Reachable over the internet with ordinary HTTP requests. | Raises score |
AC:H Attack Complexity: High | The exploit must be tuned to each target’s memory layout; it is not a one-request copy-paste. | Lowers score |
AT:P Attack Requirements: Present | Success depends on deployment conditions (SAPI, limits, worker reuse) the attacker does not control. | Lowers score |
PR:N Privileges Required: None | No account, no login. | Raises score |
UI:N User Interaction: None | Nobody has to click anything. | Raises score |
VC:H / VI:H / VA:H Vulnerable system impact: High | Full confidentiality, integrity and availability loss on the PHP server. | Raises score |
SC:N / SI:N / SA:N Subsequent system impact: None | The score does not count pivoting to other systems — in practice stolen credentials often allow it. | Lowers score |
The fix is a PHP update
Install a fixed release and restart every PHP worker. Patch guide →
If you cannot update immediately, php.net lists these partial measures:
memory_limit = -1 set so applications cannot override it (php_admin_value in the FPM pool or Apache config), paired with a container or cgroup memory limit.post_max_size: 8M without file uploads, 32M with them; keep upload_max_filesize below it.RLIMIT_AS / RLIMIT_DATA (ulimit -v, systemd LimitAS=) — they trigger the same vulnerable allocation failure.Yes. It is reached while PHP parses the incoming request, before any application code, routing or authentication runs.
No. That setting targets confirmed paths of CVE-2026-109619. The primary configuration mitigation for CVE-2026-109618 is an administratively set memory_limit = -1 together with a cgroup memory cap, and even that is incomplete.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21 October 2026. Source backports exist for 7.4, 8.0 and 8.1; distributions ship their own patched packages.
The advisory rates FPM as susceptible by source analysis and the PHP Foundation says RCE was confirmed on FPM through application-level code paths. The most direct demonstrated case is Apache with mod_php at default limits.