CVE-2026-109618

Description officielle (NVD)

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Preuves de concept publiques (385)

Dépôts tiers non vérifiés, parfois piégés. Ne les exécutez jamais en production : uniquement dans un environnement de test isolé.

• ikow/php2shell-poc · ★ 1385 · 21/10/2026
  CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
• eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC · ★ 808 · 21/10/2026
  Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes onl
• assetnote/php2shell-scanner · ★ 152 · 22/10/2026
  High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
• junaire/CVE-2026-109618-exploit · ★ 121 · 21/10/2026
• JoasASantos/php2shell-scanner · ★ 89 · 21/10/2026
  Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.
• HOSTED-POWER/php_uploadprogress_guard · ★ 86 · 21/10/2026
  Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. PHP
• syrex1013/php2shell · ★ 85 · 21/10/2026
  CVE-2026-109618/109619 PoC — PHP session.upload_progress heap use-after-free (CVSS 9.2)
• syhunt/php2shell-protection · ★ 70 · 21/10/2026
  Emergency Apache mitigation and testing toolkit for php2shell (CVE-2026-109618 / CVE-2026-109619), featuring multipart POST blocking, request-size limits, and additional hardening measures.
• Zer061/CVE-2026-109618 · ★ 61 · 21/10/2026
  PoC CVE-2026-109618 / -109619 (PHP session.upload_progress heap UAF)
• devploit/php2shell · ★ 50 · 21/10/2026
  PHP2Shell: version-aware research toolkit for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP session.upload_progress (mod_php). Build profiles, labs, heap calibration and detection guidance f

Les 10 dépôts les plus suivis sont affichés.

Références

• https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w — Mitigation, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/10/21/6
• https://www.wiz.io/blog/php2shell-php-rce — Third Party Advisory

En bref

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS : probabilité estimée d'exploitation dans les 30 prochains jours.

Produits concernés

Sources officielles

Besoin d'aide ?

Nos experts évaluent votre exposition et vous accompagnent dans la correction.