Overview
PHP is a popular general-purpose scripting language that powers 75% to 80% of all website in the world, Calif,OpenAI and Wiz security researchers, uncovered multiple critical vulnerabilities in core PHP, Where the attack access the application remotely and take control of the servers, steal sensitive data and deface the website running on them.
What is the Flaw ?
PHP can leave its memory in a corrupted state when a request ends abnormally, for example, after an out-of-memory error or a fatal error. There are two separate flaws, and each can be exploited to achieve Remote Code Execution(RCE).
Who is at Risk ?
All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
Technical Overview
RCE via OOM corruption, CVE-2026-109618
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it is fully initialized. If any allocation fails at that point, PHP does not properly account for the early exit and leaves the request memory in an invalid state. The failed allocation does not need to be related to the invalid memory. The request shutdown procedure may then read or branch on it. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
RCE via stale global state, CVE-2026-109619
PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, session and error handling operations run before normal initialization of the next request. They inadvertently access stale state not reset by the previous request before initialization has a chance to replace it, causing a use after free. A strategically crafted heap layout can produce full remote code execution (RCE).
| CVE Number | CVSS | Description |
| CVE-2026-109618 | 9.2 (Critical) | RCE via OOM corruption |
| CVE-2026-109619 | 9.2 (Critical) | RCE via stale global state |
How were the Flaws found?
Based on Wiz and Calif writeups, few issues map to two critical vulnerabilities ( CVE 2026- 109618 and CVE 2026-109619, Wiz reasearcher using GPT 5.6 and Gemini 4 Agron) Where they discover Remote process- memory disclosure; Opchace type confusion; Fatal- error backtrace UAF. POC on WordPress, Drupal and Joomla. Now Calif ( With LLMs) Zend HashTable OOM. Targets PHP-FPM and mod_php.
How to Protect My Website ?
Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 because PHP 8.1 and older no longer receive updates from the PHP project
For the latest mitigation guidance, refer to PHP’s OOM corruption advisory and stale global state advisory.
Closing thoughts
PHP2SHELL shows AI working on both sides of security. Where these Open- Sources might still have the most vulnerable bugs undiscovered. This is case the tools helped Calif and Wiz find these bugs. PHP’s team says the root cause behind the CVE appeared in 2024 and no exploit path was found, But now researchers using AI turned the weak spot into a working exploit
Dayanidhi Meganathan is an MSc cybersecurity student at the University of Hertfordshire and one of the editors at BCS. The views expressed are the author’s own
Share this article
Last updated 23rd October, 2026 at 6:41pm