How to fix CVE-2026-109618: php (public exploit)

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

• Severity: CRITICAL (CVSS 4.0 9.2, vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
• Weakness: CWE-416, CWE-755, CWE-824, CWE-1325.
• NVD published 2026-10-21, status Analyzed.

Anyone running php in the version ranges below. If the service is reachable from the internet, treat it as the priority.

• php php: from 7.3.0 up to (not including) 8.2.35.
• php php: from 8.3.0 up to (not including) 8.3.36.
• php php: from 8.4.0 up to (not including) 8.4.27.
• php php: from 8.5.0 up to (not including) 8.5.12.
• paloaltonetworks pan-os: from 10.2.0 up to (not including) 10.2.7.
• paloaltonetworks pan-os: from 11.1.0 up to (not including) 11.1.4.
• paloaltonetworks pan-os: from 11.2.0 up to (not including) 11.2.4.
• paloaltonetworks pan-os: from 12.1.0 up to (not including) 12.1.4.
• paloaltonetworks pan-os: from 12.2.0 up to (not including) 12.2.4.

Version ranges come from the NVD CPE configuration. Confirm against the vendor advisory before you rely on them.

• Exploit-DB: EDB-52704 PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE (2026-10-22, verified).
• Public proof-of-concept code: 628 GitHub repositories from 606 accounts, the first on 2026-10-21.

• EPSS (probability of exploitation activity in the next 30 days): 11.84%, higher than 96% of all scored CVEs (as of 2026-10-24).
• CVERadar threat level: 57/100 (see methodology).
• Likely ATT&CK techniques: T1203 Exploitation for Client Execution (inferred); T1190 Exploit Public-Facing Application (inferred).

1. Find every instance. List where php runs, including test, DR and forgotten internet-facing systems, and record the installed version.

   php -v

2. Upgrade to a fixed release. php php: 8.2.35 or later; php php: 8.3.36 or later; php php: 8.4.27 or later; php php: 8.5.12 or later. Get the build from the vendor advisory.

   # Debian/Ubuntu
   sudo apt update && sudo apt install --only-upgrade php
   # RHEL/Rocky/Alma/Fedora (package names differ, e.g. httpd, openssh-server, kernel)
   sudo dnf upgrade --refresh

   Distribution packages carry the fix under the distro's own version number; check your distro's security tracker for this CVE.

3. If you can't patch today, apply the vendor's workaround from the advisory, and take the service off the internet or restrict it to a VPN or allow-list until it is patched.
4. Verify the fix. Re-run the version check above on every instance and confirm it reports the fixed build (8.2.35 or later). Re-scan from outside if the service is exposed.
5. Hunt for signs of earlier compromise. If the system was exposed before you patched, assume it may have been hit and check the items below.
6. Rotate credentials stored on or used by the affected system if you cannot rule out compromise, and keep the logs you reviewed.

Detection hints

• T1190 Exploit Public-Facing Application: Review WAF, reverse-proxy and application logs for unusual requests to php (odd paths, oversized or encoded payloads, bursts of errors), going back to at least 2026-10-21.
• T1203 Exploitation for Client Execution: Exploitation of client or server software usually shows as crashes of the affected process followed by unexpected child processes; check EDR alerts for both.

Detection commands are generic starting points, not CVE-specific signatures. Use the indicators from the vendor advisory when it publishes them.

• NVD: CVE-2026-109618 nvd.nist.gov/vuln/detail/CVE-2026-109618
• CVE.org record www.cve.org/CVERecord?id=CVE-2026-109618
• Mitigation, Vendor Advisory github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• FIRST EPSS (2026-10-24) api.first.org/data/v1/epss?cve=CVE-2026-109618