Vigilbase CVEConnect your agent

PHP Memory Corruption Vulnerability

Exploited · KEV 2026-10-26Public exploit codeTrending #5CVE-2026-109618CWE-416CWE-755

Exploited since 2026-10-26. 4 of 8 rule sources name it; Cloudflare blocks by default. Our CRS test: partly blocked. 1 public exploit repo.

Edge rules
4/8
Our test
Partly blocked
CVSS
9.2
EPSS
100.0% Top 0.1%
Posts, 14d
72026-10-20: 0 posts2026-10-21: 0 posts2026-10-22: 0 posts2026-10-23: 0 posts2026-10-24: 0 posts2026-10-25: 0 posts2026-10-26: 0 posts2026-10-27: 0 posts2026-10-28: 0 posts2026-10-29: 0 posts2026-10-30: 0 posts2026-10-31: 0 posts2026-11-01: 1 posts2026-11-02: 6 posts
Published
2026-10-21
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing… More

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Ask Vigil

AI · answers from this page
Ask about CVE-2026-109618: who's covered, what to patch first, how vendors compare. I cite sources and won't help with attacks.

Workers AI (Llama 3.3). Can be wrong: check the cited source.

Severity, decoded

CVSS 4.0
Critical · 9.2 / 10

Exploitable over the network under specific conditions, with no privileges and no user interaction, leading to full loss of confidentiality, integrity and availability.

Over the internetNo login neededNo user actionHard to pull offFull compromise
How the score is built11 metrics
  • Attack vectorAn attacker can reach it over the internet; no access to your network needed.
    Network
  • Attack complexityThe attacker must first defeat a security measure, such as address randomisation, or obtain a secret.
    High
  • Attack requirementsThe attack only works under specific conditions, such as a race or a particular setup.
    Present
  • Privileges requiredNo account or login is needed.
    None
  • User interactionNo one has to click or open anything; the attack works on its own.
    None
  • Confidentiality impact (vulnerable system)An attacker can read all data the affected component holds, or the most sensitive parts of it.
    High
  • Integrity impact (vulnerable system)An attacker can change any data or files the affected component protects.
    High
  • Availability impact (vulnerable system)An attacker can take the component down completely or keep it from serving anyone.
    High
  • Confidentiality impact (other systems)Other systems' data is not exposed.
    None
  • Integrity impact (other systems)Other systems' data cannot be changed.
    None
  • Availability impact (other systems)Other systems keep working normally.
    None
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA's assessmentSSVC, from the CVE record
ExploitationActive

Attackers are exploiting this in the wild.

AutomatableNo

At least one step needs hands-on work, which slows mass attacks.

Technical impactTotal

A successful attack gives full control over the affected software or all of its data.

Public exploits

3 found
0 Metasploit1 Exploit-DB1 Scanner template1 GitHub PoCs

Links are to third-party code: never run it outside an isolated lab.

Timeline

  1. 2026-10-21
    CVE published
    CVE List
  2. 2026-10-21
    AWS ships a rule
    PHP2Shell_BODY
  3. 2026-10-21
    Fastly ships a rule
    Added virtual patch for CVE-2026-109618 and CVE-2026-109619
  4. 2026-10-21
    F5 ships a rule
    PHP Remote Code Execution (2)
  5. 2026-10-22
    Exploit published on Exploit-DB
    PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
  6. 2026-10-22
    Cloudflare rule names it
    Earliest entry we can see is an update
  7. 2026-10-26
    Added to CISA KEV
    Confirmed exploitation in the wild
  8. 2026-11-01
    First public exploit repository
    sahmsec/CVE-2026-109618-PHP2SHELL: POC of CVE-2026-109618(PHP2SHELL)
  9. 2026-11-01
    First social mention we saw
  10. 2026-11-02
    Our test: OWASP Core Rule Set blocked part of it
    paranoia level 1, anomaly threshold 5, default CRS settings
  11. 2026-11-02
    Our test: OWASP Core Rule Set blocked part of it
    paranoia level 2, anomaly threshold 5, default CRS settings

Social

2026-10-20: 0 posts2026-10-21: 0 posts2026-10-22: 0 posts2026-10-23: 0 posts2026-10-24: 0 posts2026-10-25: 0 posts2026-10-26: 0 posts2026-10-27: 0 posts2026-10-28: 0 posts2026-10-29: 0 posts2026-10-30: 0 posts2026-10-31: 0 posts2026-11-01: 1 posts2026-11-02: 6 posts

Exploit repos · unvetted, don't run

  • sahmsec·

    sahmsec/CVE-2026-109618-PHP2SHELL: POC of CVE-2026-109618(PHP2SHELL)

    View on GitHub

Top posts

  • Grok@grok·

    @CWettreck @SmolfSmolf7 Nein, stimmt so nicht. Mitte Oktober 2026 wurden kritische PHP-Schwachstellen (CVE-2026-109618/19, „PHP2Shell“) per KI entdeckt. Viele Regierungen (UK 32 Dienste, DE, FR, NL, BE, DK, CA, AU, Nepal 1000+, JP u.a.) schalteten Seiten vorsorglich ab, um zu p…

    ♥ 1View on X
  • Ross Nesbitt@arc-codex.com·

    Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE This article frames the risk very broadly by focusing on public-facing management interfaces, yet it also includes a highly technical threat hunt query that seems designed to filter out legitimate a… via Unit…

    View on Bluesky
  • YogiBear_XRP@Jryck791·

    Why I’m holding the launch of the application: Since PHP2Shell (CVE-2026-109618 / CVE-2026-109619) was disclosed and patched around October 20–21, the active threat environment has been elevated. Confirmed real-world PHP2Shell activity so far has been limited (no widespread mass

    View on X
  • GEDX Agency@gedxagency·

    1/ 🚨 PHP2Shell: si tu web corre en PHP 8.2–8.5, parcha hoy. CVE-2026-109618 y CVE-2026-109619 → RCE sin autenticación, CVSS 9.2. CISA ya las tiene en KEV (explotación activa). https://t.co/DKzWdxcFFJ

    View on X
  • alt@alt.pds.lefht.cc·

    3. CVE-2026-109618 · 9 people 🔥 🟥 Critical 9.2 · PHP RCE via OOM corruption

    View on Bluesky
  • alt@alt.pds.lefht.cc·

    🛡️ Most-discussed CVEs on Bluesky, last 24h 1. CVE-2026-98432 · 33 people 2. CVE-2026-97229 · 10 people 🔥 3. CVE-2026-109618 · 9 people 🔥 4. CVE-2026-111357 · 9 people 🔥 5. CVE-2026-118527 · 8 people 🔥 🔥 = on CISA's Known Exploited list · details in the thread 🧵

    View on Bluesky

Vendor statements

Quoted
CloudflareWAF Managed Rules20 quotesBlocks by default

Named by 2026-10-22; the first entry is an update, so the rule may be older.

2026-10-22Updated…c438d5ddSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619). Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…0a0c2f64Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…545d163cSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…212afcc9Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…1867b12eSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…9d9c073dSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…48143645Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…b5ccf32fSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619). Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…bcd95984Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…82dab691Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…24b1a4c6Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…302ede46Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…7975ce1bSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…e8d613faSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-28Updated…9d9c073dDefault: BlockSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6. Previous action: Block. New action: Block. Rule detection updated.
2026-10-28Updated…7975ce1bDefault: BlockSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6. Previous action: Block. New action: Block. Rule detection updated.
2026-10-30Updated…545d163cDefault: BlockSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: Block. Rule detection updated.
2026-10-30Updated…82dab691Default: BlockSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: Block. Rule detection updated.
2026-10-30Updated…212afcc9Default: BlockSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: Block. Rule detection updated.
2026-10-30Updated…24b1a4c6Default: BlockSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: Block. Rule detection updated.
AWSAWS WAF Managed Rules3 quotesRule published

First rule 2026-10-21, the day the CVE was published.

2026-10-21New ruleSource
PHP application managed rule group This release updates the following rules: PHP2Shell_BODY: Released static version 2.3 of this rule group. The new PHP2Shell_BODY rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see NIST: National Vulnerability Database: CVE-2026-109619 . For CVE-2026-109618 , the SizeRestrictions_BODY rule in the AWS WAF Core rule set (CRS) managed rule group adds protection by blocking…
2026-10-22UpdatedSource
PHP application managed rule group This release updates the following rules: PHP2Shell_BODY_Extended: Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619 .
2026-10-22New ruleSource
PHP application managed rule group This release updates the following rules: PHP2Shell_BODY_Extended: Released static version 2.4 of this rule group. The new PHP2Shell_BODY_Extended rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109618 . For more information, see NIST: National Vulnerability Database: CVE-2026-109618 . This rule group now detects CVE-2026-109618 directly. This supersedes the guidance in the version 2.3 entry, which d…
Microsoft AzureFront Door and Application Gateway WAF (DRS)No public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. The rule tables name CVEs but carry no dates, so Azure is left out of every time-to-rule figure.

Google CloudCloud Armor preconfigured WAF rulesNo public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. Google names few CVEs: the release notes start in May 2024 and the rules reference lists CVEs without dates. Its cve-canary rules are opt-in.

FastlyNext-Gen WAF virtual patches1 quoteRule published

First rule 2026-10-21, the day the CVE was published.

2026-10-21New ruleSource
Added virtual patch for CVE-2026-109618 and CVE-2026-109619. Fastly has created a virtual patch for CVE-2026-109618 and CVE-2026-109619 (php2shell) that is now available within your account. On 10/21/2026, two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (php2shell), were announced. They may allow unauthenticated attackers to achieve remote code execution (RCE) or cause a denial of service (DoS). You may be affected if you run a PHP version earlier than 8.5.12, 8.4.27, 8.3.…
F5Attack signatures (Distributed Cloud WAF)4 quotesRule published

First rule 2026-10-21, the day the CVE was published.

2026-10-21New rule200103697Source
Added: signature 200103697 "PHP Remote Code Execution (2)" (Command Execution, risk High), systems: PHP. References: CVE-2026-109618.
2026-10-21New rule200204115Source
Added: signature 200204115 "PHP Remote Code Execution (3)" (Server Side Code Injection, risk High), systems: PHP. References: CVE-2026-109618.
2026-10-22Updated200103697Source
Updated: signature 200103697 "PHP Remote Code Execution (2)" (Server Side Code Injection, risk High), systems: PHP. References: CVE-2026-109618.
2026-10-22Updated200204115Source
Updated: signature 200204115 "PHP Remote Code Execution (3)" (Server Side Code Injection, risk High), systems: PHP. References: CVE-2026-109618.
AkamaiApp & API Protector (Adaptive Security Engine)No public source

This vendor publishes no machine-readable rule changelog we can check.

OWASP CRSCore Rule Set (open source, used inside many WAFs)No public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. CRS rarely names CVEs: it relies on generic detections. Our own lab measures what it actually blocks.