CVE-2026-109618: out-of-memory corruption

What the advisory establishes

PHP uses a nonlocal exit when an allocation exhausts memory. Some operations do not safely account for that interruption when preparing request data. Later cleanup may treat partially initialized data as valid. The upstream advisory documents the route from that condition to remote code execution.

This is not a claim that any single large request compromises every server. Reachability and exploitability vary with the runtime and the operation interrupted. The defensive priority is to replace vulnerable builds, rather than attempt to predict every possible input.

Runtime differences

Apache mod_php has demonstrated attack paths during request setup before application code executes. PHP-FPM handles startup failures differently. The absence of an identical startup exploit does not establish that FPM deployments are immune to the PHP2Shell vulnerabilities.

Review both advisories and the Foundation analysis. Application-level paths, enabled extensions and worker behavior matter. An internet-facing runtime warrants urgent patch verification.

Patch and verify

• Use at least the first fixed upstream release on the relevant branch: 8.2.35, 8.3.36, 8.4.27 or 8.5.12; check for newer security releases.
• For vendor packages, use the distribution notice and full revision rather than the core PHP number alone.
• Replace or restart all serving workers after the update; validate the runtime in authenticated administration.
• If immediate patching is impossible, restrict exposure and escalate. Configuration and WAF mitigations cannot establish complete protection.