{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                "range": [
                  {
                    "introduced": "7.3.0"
                  },
                  {
                    "fixed": "8.2.35"
                  }
                ],
                "source": "CPE_RANGE"
              },
              {
                "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                "range": [
                  {
                    "introduced": "8.3.0"
                  },
                  {
                    "fixed": "8.3.36"
                  }
                ],
                "source": "CPE_RANGE"
              },
              {
                "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                "range": [
                  {
                    "introduced": "8.4.0"
                  },
                  {
                    "fixed": "8.4.27"
                  }
                ],
                "source": "CPE_RANGE"
              },
              {
                "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
                "range": [
                  {
                    "introduced": "8.5.0"
                  },
                  {
                    "fixed": "8.5.12"
                  }
                ],
                "source": "CPE_RANGE"
              }
            ]
          },
          "events": [
            {
              "introduced": "52ace952a1b65ca80fc2617f11c2fa6dd03f51bd"
            },
            {
              "fixed": "09a9f29a0402bb87bb448cb2e3149ccbec1699c6"
            },
            {
              "introduced": "d26068059e83fe40de3430a512471d194119bee0"
            },
            {
              "fixed": "5ba6ad519229ac09fc4fc74155c76bdca69ae0de"
            },
            {
              "introduced": "b437f2b32eb364c9496d24abcc734272e5c9c980"
            },
            {
              "fixed": "00d8bae801541db0d95a698e108bb4b1b273fe6e"
            },
            {
              "introduced": "685e99655ae97c667950f7f7d176985958718f56"
            },
            {
              "fixed": "136e049ac10b032c83018e65b63b6df858943750"
            }
          ],
          "repo": "https://github.com/php/php-src",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-w8hw-w9fx-j79w"
  ],
  "database_specific": {
    "cna_assigner": "php",
    "cwe_ids": [
      "CWE-1325",
      "CWE-1419",
      "CWE-416",
      "CWE-755",
      "CWE-824"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109618.json"
  },
  "details": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).",
  "id": "CVE-2026-109618",
  "modified": "2026-11-11T02:30:41.402617272Z",
  "published": "2026-10-21T13:48:34.845Z",
  "references": [
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2026/Oct/51"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/10/21/6"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/10/23/5"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-166980.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-566435.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-566512.html"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618"
    },
    {
      "type": "ADVISORY",
      "url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109618.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109618"
    },
    {
      "type": "ADVISORY",
      "url": "https://php2shell.delftintellab.com"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.wiz.io/blog/php2shell-php-rce"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "RCE via OOM corruption"
}