CVE-2026-109618 — Glossary

The longer version

The PHP project describes a condition in which memory allocation fails while request data is only partly initialized. An interruption can leave internal data in a state that later cleanup code treats as valid, allowing unsafe memory access.

Security researchers reported potential unauthenticated remote code execution in exposed web-serving PHP configurations. Exploit conditions vary by server interface and code path; a proof of concept against Apache mod_php is not automatic proof that every PHP-FPM installation has the same exploitation route.

The upstream security fix was released on 21 October 2026 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Vendor-supported packages may apply an equivalent source-level fix while retaining a different displayed version string.

Install the appropriate fixed build and restart active PHP workers. Check the version and package advisory together, and investigate unexpected PHP worker crashes, multipart request bursts or commands launched by the web-serving account if previous exposure is possible.

Where we use “CVE-2026-109618”

CybersecurityPHP2Shell Workarounds for PHP 8.1 and Older
PHP 8.1 and older got no official PHP2Shell releases, so protection depends on a documented vendor backport. Here is what temporary mitigations can and can’t do, and how to cut exposure while you migrate.
Nov 5, 2026Key term
CybersecurityDoes Updating WordPress Fix PHP2Shell?
A WordPress update does not fix PHP2Shell, because the flaws sit in the PHP runtime that handles requests before WordPress runs. Here is how to check your build, what to ask your host, and which separate WordPress fixes still apply.
Nov 5, 2026
CybersecurityDisabling PHP Upload Progress: What It Covers
One PHP setting blocks the confirmed session paths of CVE-2026-109619 and mitigates CVE-2026-115560, but it does nothing for CVE-2026-109618. Here is where to set it and what it breaks.
Nov 4, 2026

The longer version

Where we use “CVE-2026-109618”

Get the Core in your inbox.