9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-109618

CVE-2026-109618: RCE via OOM corruption

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Miggo Vulnerability Database

→

CVE-2026-109618

CVE-2026-109618:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
php-src	php	< 8.2.35	8.2.35
php-src	php	< 8.3.36	8.3.36
php-src	php	< 8.4.27	8.4.27
php-src	php	< 8.5.12	8.5.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

CVE-2026-109618 (PHP2Shell) is a critical unauthenticated RCE in PHP's core engine. The root cause is PHP's use of longjmp()/bailout for out-of-memory errors: when an allocation fails, PHP exits the current context without unwinding, leaving request-owned memory published in persistent globals (BG(unserialize), PS(id), EG(last_fatal_error_backtrace), etc.). The request heap is then freed while those globals still point into it, and a later request handled by the same worker consumes the stale pointers before normal request initialization resets them. The confirmed exploit chain uses multipart upload-progress handling: php_session_rfc1867_callback runs during request startup, php_session_initialize publishes PS(id), and php_session_decode invokes php_var_unserialize, which stores bookkeeping in BG(unserialize). An OOM during this path aborts before cleanup, producing a cross-request use-after-free that can be shaped into memory disclosure (PHPSESSID cookie leaking heap contents) and ultimately RCE. The patch (commit 31c0ea7d) fixes this by replacing bailout-on-OOM with a delayed graceful soft OOM plus a hard _exit() threshold, and by properly resetting the affected globals (e.g., adding PS(in_rfc1867_update) = false to php_rinit_session_globals and reworking the unserializer's BG(unserialize) lifecycle). The functions listed above are the ones that contain the vulnerable state handling and would appear in a runtime profile/stack trace during exploitation.

Vulnerable functions

php_session_rfc1867_callback

ext/session/session.c

This is the RFC1867 multipart upload-progress callback. It runs during request startup (before normal session module initialization) and initializes session state, publishing PS(id) and invoking the session decoder. When an OOM longjmp/bailout interrupts this path, the request heap is freed while persistent session globals still reference it, producing the cross-request use-after-free that is the core of CVE-2026-109618.

php_session_decode

ext/session/session.c

Decodes session data through the configured serializer (php_var_unserialize for the default serializer). It stores request-owned bookkeeping in BG(unserialize). An OOM during decode triggers zend_bailout(), abandoning the operation before the matching reset, leaving BG(unserialize) pointing to freed request memory that a later request consumes.

php_var_unserialize

ext/standard/var_unserializer.re

The unserializer entry point. It allocates and publishes the php_unserialize_data bookkeeping in the BG(unserialize) global. When an allocation fails mid-parse, the OOM bailout skips php_var_unserialize_destroy, so the global keeps pointing to freed request memory. A subsequent request's upload-progress decode consumes this stale state as live unserializer bookkeeping, giving the memory-corruption primitive.

php_var_unserialize_internal

ext/standard/var_unserializer.re

The internal recursive unserializer that performs the actual parsing and allocation. It is the function where the OOM allocation failure occurs while BG(unserialize) is published, and where the stale-state corruption is later consumed during a subsequent request.

php_session_initialize

ext/session/session.c

Initializes session state and publishes PS(id). During upload-progress handling this runs before normal module initialization. An OOM after PS(id) is published but before cleanup leaves PS(id) pointing into the freed request heap; a later multipart request URL-encodes the reclaimed heap contents into a PHPSESSID cookie (the remote process-memory disclosure primitive).

php_rinit_session_globals

ext/session/session.c

Resets per-request session globals. In the vulnerable version it failed to reset the in_rfc1867_update flag, allowing stale upload-progress/session state to be consumed before normal initialization replaced it.

zend_error_zstr_at

Zend/zend.c

Central error-reporting function that stores the fatal-error backtrace in EG(last_fatal_error_backtrace). An OOM fatal error destroys the request heap without undefining this executor-global value, leaving a dangling backtrace that a later request's early diagnostic consumes (the fatal-error backtrace use-after-free, CVE-2026-109619, which is part of the same patch family).

zend_deactivate

Zend/zend.c

Request deactivation/cleanup routine. In the vulnerable version it did not account for the delayed OOM state, so request shutdown could read or branch on memory left invalid by an OOM longjmp.

zend_execute_script

Zend/zend.c

Executes the main script. The patch adds handling for a delayed OOM after execution; the vulnerable version lacked this, so an OOM raised during execution could leave request state invalid for the subsequent shutdown procedure.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

9.8

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-109618: RCE via OOM corruption

CVE-2026-109618:

9.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

9.8

9.8

Technical Details

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-109618: RCE via OOM corruption

9.8

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-109618: RCE via OOM corruption

CVE-2026-109618:

9.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

9.8

9.8

Technical Details

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-109618: RCE via OOM corruption

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI