CVE-2026-109618 — PHP2Shell memory corruption

The memory corruption path of PHP2Shell, rated CVSS v4.0 9.2 Critical and fixed on 21 October 2026.

What it is

CVE-2026-109618 is the memory corruption path of PHP2Shell. The PHP project describes it as a heap memory corruption that is reachable through request body handling and can be triggered when that handler runs out of memory. A remote attacker who can send ordinary requests to a PHP endpoint is in a position to reach it. It is rated CVSS v4.0 9.2, Critical.

Affected and fixed releases

Who is most exposed

Sites running Apache mod_php carry the most risk, because the flaw can be reached before application code executes — the usual application-level protections never get a chance to run. PHP-FPM pools, php-cgi, LiteSpeed and FrankenPHP are also affected, since the path is in request body handling rather than in any one framework.

Fix checklist

1. Identify the branch you are on with php -v.
2. Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 — whichever matches your branch.
3. Confirm the version is loaded by the SAPI that serves requests, not just installed on disk.
4. Restart the PHP workers and the web server.
5. Re-run the check and confirm the reported version changed.

On PHP 8.1 or earlier there is no official fix. Upgrade the branch; backported builds from a distribution or LTS vendor are the only other route.

Related

• CVE-2026-109619 — the stale global state path
• What PHP2Shell is, and how to mitigate without upgrading

Frequently asked

Is the severity 10.0?

No. The PHP project rates both flaws 9.2 under CVSS v4.0. Claims of 10.0 do not come from the advisory.

My scanner says the site is fine. Is that enough?

Only if it checked the version on the server itself. Header-based checks cannot see through a CDN or a reverse proxy.

Does hiding the PHP version protect me?

No. It only removes a hint.