CVE-2026-109618 Explained: RCE via OOM Corruption in PHP
CVE-2026-109618, titled “RCE via OOM corruption,” is one half of PHP2Shell. It is rated CVSS 9.2 and enables unauthenticated remote code execution. Here is what is happening under the hood.
The root cause
When a PHP request exhausts its memory budget, PHP historically used a non-local jump (longjmp()) to bail out of the current operation and begin shutting the request down. The problem: in some code paths, request memory is reachable before it has been fully initialized. If an allocation fails right there, the early jump leaves that memory in an invalid, partially-constructed state — and the request-shutdown logic then reads from it, or makes decisions based on it.
Reading and branching on corrupted, attacker-influenceable memory is exactly the primitive an exploit needs. With a carefully shaped heap, that corruption becomes control over execution.
How it is triggered
The out-of-memory condition is reached through edge cases in multipart/form-data parsing. That matters for two reasons: multipart bodies are parsed by PHP before your application runs, and they are fully attacker-controlled. So an unauthenticated POST to almost any PHP endpoint can drive the engine into the vulnerable state. The confirmed-exploitable configuration is Apache mod_php.
The memory-disclosure angle
Beyond code execution, researchers demonstrated that the corrupted state can leak chunks of a worker's memory back to the attacker — observed in the PHPSESSID response cookie. Because PHP workers are reused across requests, that memory can contain data from other visitors: credentials, session identifiers, API keys, even TLS private keys. The disclosure works even when the vulnerable application never starts a session itself.
The fix
The official patch removes longjmp() for out-of-memory errors entirely. Instead, PHP now records the condition and applies a delayed “soft limit” at the next safe point in the virtual machine, plus an immediate hard stop via _exit() at a higher threshold. In short: no more jumping out of half-initialized code, so there is no corrupted window to abuse.
Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Updating PHP is the only complete remedy.