CVE-2026-109618

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

• CWE-416
• CWE-755
• CWE-824
• CWE-1325

• https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79wMitigation, Vendor Advisory
• https://seclists.org/fulldisclosure/2026/Oct/51Mailing List
• https://www.openwall.com/lists/oss-security/2026/10/21/6Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2026/10/23/5Mailing List, Third Party Advisory
• https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/Third Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-166980.htmlThird Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-566435.htmlThird Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-566512.htmlThird Party Advisory
• https://php2shell.delftintellab.comThird Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618US Government Resource
• https://www.wiz.io/blog/php2shell-php-rceThird Party Advisory

Published

Oct 21, 2026

Last Modified

Nov 5, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-109612Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 conta…7.3
• CVE-2026-109613Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 conta…7.1
• CVE-2026-109614Frappe ERPNext before 16.34.0 contains a missing authorizati…6.5
• CVE-2026-109615Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 conta…6.5
• CVE-2026-109616Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 conta…7.1
• CVE-2026-109617Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 conta…7.1
• CVE-2026-109619PHP has various global state that temporarily points into re…8.1
• CVE-2026-10962Type Confusion in Media in Google Chrome prior to 149.0.7827…8.8
• CVE-2026-109620A vulnerability has been found in SourceCodester Online Revi…7.3
• CVE-2026-109621Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 conta…6.5
• CVE-2026-109622Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 conta…4.3
• CVE-2026-109623Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 conta…5.4