CVE-2026-109618
CVSS 9.8 CRITICAL: pHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. EPSS 100% (100th percentile).
Vulnerabilities · 4h ago
BleepingComputer reports that attackers are successfully exploiting two critical PHP remote code execution (RCE) flaws, CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell.
Earlier proof-of-concept demos raised reliability questions because they used an 8 MB memory limit. The flaws abuse PHP’s handling of memory exhaustion and request data to reach code execution on the server; confirmed exploitation means that unusual demo setting cannot establish safety at the more typical 128 MB limit. The report does not explain the attacker-facing steps.
For teams running PHP services exposed to untrusted requests, this is now an incident concern, but the report names no affected versions, configurations, victims, or post-compromise activity. Without those boundaries, the exposure cannot yet be narrowed to deployments that resemble the published demos.
CVSS 9.8 CRITICAL: pHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. EPSS 100% (100th percentile).
CVSS 9.8 CRITICAL: pHP has various global state that temporarily points into request memory. EPSS 100% (100th percentile).
2 sources covering this story
PHP2Shell security flaws now sucessfully exploited in the wild
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.
(Reliable)? php2shell exploitability - SANS ISC
php2shell exploitability, Author: Bojan Zdrnja
Part of the PlainSec briefing for 2026-10-26