Out-of-memory longjmp corruption in PHP core gives unauthenticated remote code execution (CVE-2026-109618)
VulnCheck's canary sensors recorded exploitation attempts on 2026-10-21 and 2026-10-22, AWS and other firms saw attempts before the emergency 8.2.35/8.3.36/8.4.27/8.5.12 releases shipped yesterday, and six public exploits are already catalogued — an unpatched internet-facing PHP host can be taken over with a single crafted request sequence.
PHP aborts a request on out-of-memory via longjmp(), but in some contexts request memory is reachable before it is fully initialized; an attacker who forces an allocation failure at that point leaves the request in an invalid state that the cleanup path then reads, and several reliable OOM strategies turn this into remote code execution. It is the second of the two PHP2Shell flaws, affects every supported PHP branch, and requires neither authentication nor user interaction.
Affected: PHP < 8.2.35; PHP 8.3.0 – 8.3.35; PHP 8.4.0 – 8.4.26; PHP 8.5.0 – 8.5.11
How to Test
Confirm the PHP version on every web host, container image and PHP-FPM pool against the fixed builds 8.2.35, 8.3.36, 8.4.27 and 8.5.12 — anything lower is vulnerable, including distribution packages that have not yet backported the fix. Deploy the Snort rules Talos published in the Community Ruleset for the PHP2Shell CVEs and review web server and PHP-FPM logs since 2026-10-21 for the request patterns in the ellio.tech and AWS write-ups, for bursts of PHP memory-exhaustion (out-of-memory) errors from a single client, and for unexpected processes spawned by the web server user.
How to Patch
Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (the project's out-of-cycle security release of 2026-10-21) and rebuild any container images that bundle PHP. Where the upgrade cannot land immediately, follow the maintainers' and NCSC's guidance to take exposed PHP applications offline until patched.