Vulnerability of 26 October 2026 · CVE-2026-109618

PHP Use after free

9.8 CVSS · criticalExploited

Use after free in PHP. Exploitable over the network, without logging in, without any user action. CVSS 9.8 (critical). According to CISA it is already being exploited. Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Vendor security advisory

github.com · The vendor’s information prevails.

At a glance

CVE

CVE-2026-109618

Product

PHP

Vendor

The PHP Group

Affected versions

≥ 8.2.0, < 8.2.35
≥ 8.3.0, < 8.3.36
≥ 8.4.0, < 8.4.27
≥ 8.5.0, < 8.5.12

per the vendor or CVE issuer

Fixed in

8.2.35, 8.3.36, 8.4.27, 8.5.12

CVSS

9.8 (critical)
CVSS 3.1, scored by NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known exploited

Yes, per CISA (in the KEV catalog since 26 October 2026)

Weakness type

CWE-416 (Use after free), CWE-755, CWE-824, CWE-1325

Published

21 October 2026

Last modified

30 October 2026

What to do

Update to a fixed version: 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later, depending on the release line you run.
Read the vendor’s report: it gives the exact versions and, where available, workarounds in case you cannot update right away.
Since it is already exploited: after updating, check whether the system was compromised before.
Also check test, staging and forgotten installations of the same software.

Vendor security advisory ↗

Original description

From the CVE record. The summary above is built from the structured data.

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Name at CISA: PHP Memory Corruption Vulnerability

Official references

github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79wMitigationVendor advisory
arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-executionThird-party advisory
cert-portal.siemens.com/productcert/html/ssa-566512.htmlThird-party advisory
php2shell.delftintellab.comThird-party advisory
cisa.gov/known-exploited-vulnerabilities-catalogUS government
wiz.io/blog/php2shell-php-rceThird-party advisory
cert-portal.siemens.com/productcert/html/ssa-166980.html
cert-portal.siemens.com/productcert/html/ssa-566435.html

Sources

Data from NIST’s NVD and CISA’s KEV catalog, retrieved on 1 November 2026. This product uses data from the NVD API but is not endorsed or certified by the NVD. No liability is accepted for this information.

NVD entry ↗CVE.org record ↗CISA KEV catalog ↗

Which software versions does your website give away? The free security check finds out.

Check for free