# CVE-2026-109618: PHP Memory Corruption Vulnerability - Exploited (CISA KEV): yes, added 2026-10-26 - Published: 2026-10-21 - CVSS: 9.2 CRITICAL (v4.0) - EPSS: 100.0% (100th percentile) - CWE: CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). ## Edge WAF coverage (claimed by vendors, not measured) | Vendor | Status | First rule | Days after publication | |---|---|---|---| | Cloudflare | Blocks by default | 2026-10-22 | — | | AWS | Rule published | 2026-10-21 | 0 | | Microsoft Azure | No public claim | — | — | | Google Cloud | No public claim | — | — | | Fastly | Rule published | 2026-10-21 | 0 | | F5 | Rule published | 2026-10-21 | 0 | | Akamai | No public source | — | — | | OWASP CRS | No public claim | — | — | ### Cloudflare - 2026-10-22 · updated · rule c1d409ad838f47f59446f21cc438d5dd > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619). Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/ - 2026-10-22 · updated · rule f9a45927414245e3a64bb12d0a0c2f64 > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/ - 2026-10-22 · updated · rule 771c654ae1154d4daa72f4e1545d163c > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/ - 2026-10-22 · updated · rule 217005865f0145f392300bac212afcc9 > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/ - 2026-10-22 · updated · rule 38efdb17ea594501bb55a1d71867b12e > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/ - 2026-10-22 · updated · rule 4148ae686fdb4d01be673fab9d9c073d > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/ - 2026-10-22 · updated · rule 1389aa259617437392ce149c48143645 > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-cfmr/ - 2026-10-22 · updated · rule 4e315666e8e344cdb64119a3b5ccf32f > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619). Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/ - 2026-10-22 · updated · rule 00c10e6cc4da4bd08722adeebcd95984 > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/ - 2026-10-22 · updated · rule 48ddf592361e4fdb97a8a85982dab691 > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/ - 2026-10-22 · updated · rule 3556683d512a47f2937899c524b1a4c6 > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/ - 2026-10-22 · updated · rule da07c85852e34625bb478496302ede46 > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/ - 2026-10-22 · updated · rule 19373a83abb840e18ab3ce5a7975ce1b > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/ - 2026-10-22 · updated · rule 07f0b6ddaabf40b1b2042dade8d613fa > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged. Source: https://developers.cloudflare.com/changelog/post/2026-10-22-emergency-waf-release-free/ - 2026-10-28 · updated · rule 4148ae686fdb4d01be673fab9d9c073d · default Block > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6. Previous action: Block. New action: Block. Rule detection updated. Source: https://developers.cloudflare.com/changelog/post/2026-10-28-waf-release/ - 2026-10-28 · updated · rule 19373a83abb840e18ab3ce5a7975ce1b · default Block > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6. Previous action: Block. New action: Block. Rule detection updated. Source: https://developers.cloudflare.com/changelog/post/2026-10-28-waf-release/ - 2026-10-30 · updated · rule 771c654ae1154d4daa72f4e1545d163c · default Block > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: Block. Rule detection updated. Source: https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/ - 2026-10-30 · updated · rule 48ddf592361e4fdb97a8a85982dab691 · default Block > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: Block. Rule detection updated. Source: https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/ - 2026-10-30 · updated · rule 217005865f0145f392300bac212afcc9 · default Block > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: Block. Rule detection updated. Source: https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/ - 2026-10-30 · updated · rule 3556683d512a47f2937899c524b1a4c6 · default Block > PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: Block. Rule detection updated. Source: https://developers.cloudflare.com/changelog/post/2026-10-30-waf-release/ ### AWS - 2026-10-21 · new > PHP application managed rule group This release updates the following rules: PHP2Shell_BODY: Released static version 2.3 of this rule group. The new PHP2Shell_BODY rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see NIST: National Vulnerability Database: CVE-2026-109619 . For CVE-2026-109618 , the SizeRestrictions_BODY rule in the AWS WAF Core rule set (CRS) managed rule group adds protection by blocking… Source: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html - 2026-10-22 · updated > PHP application managed rule group This release updates the following rules: PHP2Shell_BODY_Extended: Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619 . Source: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html - 2026-10-22 · new > PHP application managed rule group This release updates the following rules: PHP2Shell_BODY_Extended: Released static version 2.4 of this rule group. The new PHP2Shell_BODY_Extended rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109618 . For more information, see NIST: National Vulnerability Database: CVE-2026-109618 . This rule group now detects CVE-2026-109618 directly. This supersedes the guidance in the version 2.3 entry, which d… Source: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html ### Fastly - 2026-10-21 · new > Added virtual patch for CVE-2026-109618 and CVE-2026-109619. Fastly has created a virtual patch for CVE-2026-109618 and CVE-2026-109619 (php2shell) that is now available within your account. On 10/21/2026, two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (php2shell), were announced. They may allow unauthenticated attackers to achieve remote code execution (RCE) or cause a denial of service (DoS). You may be affected if you run a PHP version earlier than 8.5.12, 8.4.27, 8.3.… Source: https://www.fastly.com/documentation/reference/changes/2026/10/added-virtual-patch-for-CVE-2026-109618-and-CVE-2026-109619/ ### F5 - 2026-10-21 · new · rule 200103697 > Added: signature 200103697 "PHP Remote Code Execution (2)" (Command Execution, risk High), systems: PHP. References: CVE-2026-109618. Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog - 2026-10-21 · new · rule 200204115 > Added: signature 200204115 "PHP Remote Code Execution (3)" (Server Side Code Injection, risk High), systems: PHP. References: CVE-2026-109618. Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog - 2026-10-22 · updated · rule 200103697 > Updated: signature 200103697 "PHP Remote Code Execution (2)" (Server Side Code Injection, risk High), systems: PHP. References: CVE-2026-109618. Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog - 2026-10-22 · updated · rule 200204115 > Updated: signature 200204115 "PHP Remote Code Execution (3)" (Server Side Code Injection, risk High), systems: PHP. References: CVE-2026-109618. Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog ## Our test (measured) - OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: partial (1 of 3 requests blocked), template CVE-2026-109618, 2026-11-02 - OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: partial (1 of 3 requests blocked), template CVE-2026-109618, 2026-11-02 ## Social 10 posts seen since 2026-11-01. - Exploit repository (unvetted): https://github.com/sahmsec/CVE-2026-109618-PHP2SHELL - x 2026-11-02: @CWettreck @SmolfSmolf7 Nein, stimmt so nicht. Mitte Oktober 2026 wurden kritische PHP-Schwachstellen (CVE-2026-109618/19, „PHP2Shell“) per KI entdeckt. Viele Regierungen (UK 32 Dienste, DE, FR, NL, BE, DK, CA, AU, Nepal 1000+, JP u.a.) schalteten Seiten vorsorglich ab, um zu p… (https://x.com/grok/status/2117381135231586310) - x 2026-11-02: @TweetThreatNews The key point now is that a PHP patch is available — this PHP vulnerability should not be left unpatched while exploitation attempts are already being reported. PHP2Shell is CVE-2026-109618 + CVE-2026-109619, an unauthenticated RCE with a PHP CVSS v4.0 score of… (https://x.com/PHPSiteAudit/status/2117388469576093855) - x 2026-11-02: Reversing Labs says AI-assisted research chained dormant PHP flaws CVE-2026-109618 and CVE-2026-109619 into PHP2Shell. It reports that pre-disclosure leaks triggered panic and early exploitation attempts before a patch was released. https://t.co/vu5XgKQlat (https://x.com/TweetThreatNews/status/2117382289730490581) - bluesky 2026-11-02: Reversing Labs says AI-assisted research chained dormant PHP flaws CVE-2026-109618 and CVE-2026-109619 into PHP2Shell. It reports that pre-disclosure leaks triggered panic and early exploitation attempts before a patch was released. (https://bsky.app/profile/hendryadrian.bsky.social/post/3mzeehi2jlg2y) - bluesky 2026-11-02: Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE This article frames the risk very broadly by focusing on public-facing management interfaces, yet it also includes a highly technical threat hunt query that seems designed to filter out legitimate a… via Unit… (https://bsky.app/profile/arc-codex.com/post/3mzebxsutmp26) "No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it. HTML: https://cve.vigilbase.com/cve/CVE-2026-109618 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-109618