CVE-2026-109618
CVSS 9.8 CRITICAL: pHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. EPSS 100% (100th percentile).
Vulnerabilities & Exploits
Qualys reported that only 199,000 of 156 million PHP installations had been patched in the first 12 hours after fixes for PHP2Shell, CVE-2026-109618 and CVE-2026-109619, became available.
The flaws involve PHP running out of memory and using a nonlocal jump—a way to leave the current request-handling path immediately—while global state can still point to memory owned by that request. In plain terms, the request can end before PHP clears references to it, making cleanup and state handling unsafe.
Qualys presents temporary controls as a bridge while updates spread. For organizations running PHP across many hosts or application teams, the global count does not show which instances are protected; uneven rollout can leave vulnerable and updated systems side by side until the patch reaches each part of the estate.
1 source · 14h ago
CVSS 9.8 CRITICAL: pHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. EPSS 100% (100th percentile).
CVSS 9.8 CRITICAL: pHP has various global state that temporarily points into request memory. EPSS 100% (100th percentile).
Qualys
Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own
PHP2Shell’s fix is to update PHP, but patching at scale is slow.
originalPart of the PlainSec briefing for 2026-10-26
Every edition of this story: PHP patch rollout leaves most installations vulnerable