CVE-2026-109618: PHP Core OOM Memory State Corruption & RCE
Comprehensive security advisory for CVE-2026-109618 (PHP2Shell): affected PHP versions matrix, root cause in Zend OOM handling, and emergency mitigation.
Check Your Server Vulnerability Status
Verify if your specific PHP-FPM / CLI build is affected by CVE-2026-109618.
Vulnerability Attributes & Classification
- CVE Identifier
- CVE-2026-109618
- Threat Name
- PHP2Shell
- Vulnerable Component
- main/rfc1867.c (ZEND_HAS_OOM)
- Default Exposure
- Vulnerable by Default (session.upload_progress.enabled = On)
- Attack Vector
- Network / Remote (Unauthenticated HTTP POST)
- Official Fix
- commit 1d7dec1 (Arnaud Le Blanc & Ilija Tovilo)
Affected & Secure PHP Versions Matrix
Complete breakdown of PHP runtime versions vulnerable to CVE-2026-109618. Systems running unpatched builds must execute emergency remediation.
| PHP Branch | Vulnerability Status | Patched Version | Mitigation Action |
|---|---|---|---|
| PHP 8.5 | Patched Upstream | 8.5.12 | Upgrade to 8.5.12+ |
| PHP 8.4 | Patched Upstream | 8.4.27 | Upgrade to 8.4.27+ |
| PHP 8.3 | Patched Upstream | 8.3.36 | Upgrade to 8.3.36+ |
| PHP 8.2 | Patched Upstream | 8.2.35 | Upgrade to 8.2.35+ |
| PHP 8.1 (EOL) | Vulnerable (Unpatched) | None | Apply backport commit 1d7dec1 or disable upload_progress |
| PHP 7.0–8.0 | Vulnerable (Unpatched) | None | Must set session.upload_progress.enabled = Off |
| PHP 5.4–5.6 | Vulnerable (Introduced) | None | Must set session.upload_progress.enabled = Off |
Technical Root Cause & Mechanics
CVE-2026-109618 stems from an Out-Of-Memory (OOM) handling flaw inside main/rfc1867.c. When processing multipart/form-data POST streams, an induced memory allocation failure trips a longjmp bailout. Because internal parser structures are left in an incomplete state without zeroing global pointer references, subsequent teardown handlers dereference freed heap chunks, culminating in controlled memory corruption.
The flaw triggers before user-space application code ever executes. Application-layer filters, WordPress plugins (Wordfence/Sucuri), and Laravel middleware are physically bypassed because the core C parser handles the stream first.
Step-by-Step Emergency Remediation
Method 1: One-Line Configuration Workaround (Zero Downtime)
Disable upload progress tracking in your global php.ini across CLI and FPM pools:
session.upload_progress.enabled = OffMethod 2: Reload Worker Daemons
Reload the PHP-FPM service to flush running worker pools:
sudo systemctl reload php*-fpm || sudo systemctl restart apache2