Skip to content
OpenAdvisories
Critical · 9.2 Known exploited Scanner template Public exploit CVE-2026-109618 EUVD-2026-107260

RCE via OOM corruption

Published Oct 21, 2026 · Updated Nov 5, 2026 · Assigned by php

Vendor: PHP Group Product: PHP Package: php Package: php-8.2 Package: php-8.3 Package: php-8.4 Package: php-8.5 Package: php-cli Package: php5 Package: php7.0 Package: php7.2 Package: php7.4 Package: php8.1 Package: php8.2 Package: php8.3 Package: php8.4 Package: php8.5 Package: php82 Package: php83 Package: php84 Package: php85 Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Affected products

VendorProductAffectedFixed
PHP Group PHP 8.2.* – < 8.2.35, 8.3.* – < 8.3.36, 8.4.* – < 8.4.27, 8.5.* – < 8.5.12 8.2.35

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 php8.4 8.4.27-1 —
Debian 13 php8.4 8.4.27-1~deb13u1 —
Debian 12 php8.2 8.2.35-1~deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 php8.5 8.5.9-0ubuntu2.1 USN-8948-1
Ubuntu 26.04 LTS php8.5 8.5.4-0ubuntu1.5 USN-8948-1
Ubuntu 24.04 LTS php8.3 8.3.6-0ubuntu0.24.04.13 USN-8948-1
Ubuntu 22.04 LTS php8.1 8.1.2-1ubuntu2.28 USN-8948-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS php7.4 7.4.3-4ubuntu2.29+esm5 USN-8948-2
Ubuntu Pro 18.04 LTS php7.2 7.2.24-0ubuntu0.18.04.17+esm14 USN-8948-2
Ubuntu Pro 16.04 LTS php7.0 7.0.33-0ubuntu0.16.04.16+esm22 USN-8948-2
Ubuntu Pro 14.04 LTS php5 5.5.9+dfsg-1ubuntu4.29+esm18 USN-8948-2

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 php +23 8.3.36-1.el10_2 RHSA-2026:87070
RHEL 10 php8.4 +23 8.4.27-1.el10_2 RHSA-2026:98609, RHSA-2026:87071
RHEL 9 apcu-panel +2 5.1.23-1.module+el9.7.0+24111+199d2cc4 RHSA-2026:97880, RHSA-2026:87079, RHSA-2026:87072
RHEL 9 php +23 8.0.30-8.el9_8.1 RHSA-2026:97880, RHSA-2026:87151, RHSA-2026:87079
RHEL 9 php-pecl-redis6 6.1.0-3.module+el9.8.0+24343+756b4fcd RHSA-2026:97880, RHSA-2026:87079
RHEL 9 php-pecl-rrd 2.0.3-4.module+el9.7.0+24111+199d2cc4 RHSA-2026:97880, RHSA-2026:87079, RHSA-2026:87072
RHEL 9 php-pecl-xdebug3 3.2.2-2.module+el9.7.0+24111+199d2cc4 RHSA-2026:97880, RHSA-2026:87079, RHSA-2026:87072
RHEL 9 php-pecl-zip 1.22.3-1.module+el9.7.0+24111+199d2cc4 RHSA-2026:97880, RHSA-2026:87079, RHSA-2026:87072
RHEL 8 apcu-panel +2 5.1.18-1.module+el8.10.0+22485+a3539972 RHSA-2026:87080, RHSA-2026:87073
RHEL 8 libzip +2 1.6.1-1.module+el8.10.0+22485+a3539972 RHSA-2026:87080, RHSA-2026:87073
RHEL 8 php +25 7.4.33-8.module+el8.10.0+25117+30337cca RHSA-2026:87080, RHSA-2026:87073
RHEL 8 php-pear 1:1.10.13-1.module+el8.10.0+22485+a3539972 RHSA-2026:87080, RHSA-2026:87073
RHEL 8 php-pecl-rrd 2.0.1-1.module+el8.10.0+22485+a3539972 RHSA-2026:87080, RHSA-2026:87073
RHEL 8 php-pecl-xdebug 2.9.5-1.module+el8.10.0+22485+a3539972 RHSA-2026:87080
RHEL 8 php-pecl-xdebug3 3.2.2-2.module+el8.10.0+20798+00eaeb41 RHSA-2026:87073
RHEL 8 php-pecl-zip 1.18.2-1.module+el8.10.0+22485+a3539972 RHSA-2026:87080, RHSA-2026:87073
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS php +23 8.3.19-1.el10_0.2 RHSA-2026:88561
RHEL 9.6 EUS apcu-panel +2 5.1.23-1.module+el9.4.0+20748+b46899d2 RHSA-2026:89111, RHSA-2026:88834
RHEL 9.6 EUS php +23 8.0.30-3.el9_6.2 RHSA-2026:89111, RHSA-2026:88834, RHSA-2026:88720
RHEL 9.6 EUS php-pecl-redis6 6.1.0-2.module+el9.6.0+22647+1741ae35 RHSA-2026:89111
RHEL 9.6 EUS php-pecl-rrd 2.0.3-4.module+el9.4.0+20748+b46899d2 RHSA-2026:89111, RHSA-2026:88834
RHEL 9.6 EUS php-pecl-xdebug3 3.2.2-2.module+el9.4.0+20796+bd4564df RHSA-2026:89111, RHSA-2026:88834
RHEL 9.6 EUS php-pecl-zip 1.22.3-1.module+el9.4.0+20748+b46899d2 RHSA-2026:89111, RHSA-2026:88834
RHEL 9.4 E4S apcu-panel +2 5.1.23-1.module+el9.4.0+20748+b46899d2 RHSA-2026:88835
RHEL 9.4 E4S php +23 8.0.30-1.el9_4.2 RHSA-2026:88835, RHSA-2026:88725
RHEL 9.4 E4S php-pecl-rrd 2.0.3-4.module+el9.4.0+20748+b46899d2 RHSA-2026:88835
RHEL 9.4 E4S php-pecl-xdebug3 3.2.2-2.module+el9.4.0+20796+bd4564df RHSA-2026:88835
RHEL 9.4 E4S php-pecl-zip 1.22.3-1.module+el9.4.0+20748+b46899d2 RHSA-2026:88835
RHEL 9.2 E4S php +23 8.0.30-1.el9_2.2 RHSA-2026:88659
RHEL 8.8 TUS apcu-panel +2 5.1.18-1.module+el8.3.0+6678+b09f589e RHSA-2026:88532
RHEL 8.8 TUS libzip +2 1.6.1-1.module+el8.3.0+6678+b09f589e RHSA-2026:88532
RHEL 8.8 TUS php +25 7.4.33-1.module+el8.8.0+25148+55cf9df9.2 RHSA-2026:88532
RHEL 8.8 TUS php-pear 1:1.10.13-1.module+el8.7.0+15127+a450a8db RHSA-2026:88532
RHEL 8.8 TUS php-pecl-rrd 2.0.1-1.module+el8.3.0+6678+b09f589e RHSA-2026:88532
RHEL 8.8 TUS php-pecl-xdebug 2.9.5-1.module+el8.3.0+6678+b09f589e RHSA-2026:88532
RHEL 8.8 TUS php-pecl-zip 1.18.2-1.module+el8.3.0+6678+b09f589e RHSA-2026:88532
RHEL 8.8 E4S apcu-panel +2 5.1.18-1.module+el8.3.0+6678+b09f589e RHSA-2026:88532
RHEL 8.8 E4S libzip +2 1.6.1-1.module+el8.3.0+6678+b09f589e RHSA-2026:88532
RHEL 8.8 E4S php +25 7.4.33-1.module+el8.8.0+25148+55cf9df9.2 RHSA-2026:88532
RHEL 8.8 E4S php-pear 1:1.10.13-1.module+el8.7.0+15127+a450a8db RHSA-2026:88532
RHEL 8.8 E4S php-pecl-rrd 2.0.1-1.module+el8.3.0+6678+b09f589e RHSA-2026:88532
RHEL 8.8 E4S php-pecl-xdebug 2.9.5-1.module+el8.3.0+6678+b09f589e RHSA-2026:88532
RHEL 8.8 E4S php-pecl-zip 1.18.2-1.module+el8.3.0+6678+b09f589e RHSA-2026:88532
RHEL 8.6 EUS Long Life apcu-panel +2 5.1.18-1.module+el8.3.0+6678+b09f589e RHSA-2026:88533
RHEL 8.6 EUS Long Life libzip +2 1.6.1-1.module+el8.3.0+6678+b09f589e RHSA-2026:88533
RHEL 8.6 EUS Long Life php +25 7.4.19-4.module+el8.6.0+25157+c2ff122e.3 RHSA-2026:88533
RHEL 8.6 EUS Long Life php-pear 1:1.10.13-1.module+el8.6.0+16577+0788886f RHSA-2026:88533
RHEL 8.6 EUS Long Life php-pecl-rrd 2.0.1-1.module+el8.3.0+6678+b09f589e RHSA-2026:88533
RHEL 8.6 EUS Long Life php-pecl-xdebug 2.9.5-1.module+el8.3.0+6678+b09f589e RHSA-2026:88533
RHEL 8.6 EUS Long Life php-pecl-zip 1.18.2-1.module+el8.3.0+6678+b09f589e RHSA-2026:88533
RHEL 8.6 AUS apcu-panel +2 5.1.18-1.module+el8.3.0+6678+b09f589e RHSA-2026:88533
RHEL 8.6 AUS libzip +2 1.6.1-1.module+el8.3.0+6678+b09f589e RHSA-2026:88533
RHEL 8.6 AUS php +25 7.4.19-4.module+el8.6.0+25157+c2ff122e.3 RHSA-2026:88533
RHEL 8.6 AUS php-pear 1:1.10.13-1.module+el8.6.0+16577+0788886f RHSA-2026:88533
RHEL 8.6 AUS php-pecl-rrd 2.0.1-1.module+el8.3.0+6678+b09f589e RHSA-2026:88533
RHEL 8.6 AUS php-pecl-xdebug 2.9.5-1.module+el8.3.0+6678+b09f589e RHSA-2026:88533
RHEL 8.6 AUS php-pecl-zip 1.18.2-1.module+el8.3.0+6678+b09f589e RHSA-2026:88533
RHEL 8.4 EUS Long Life apcu-panel +2 5.1.18-1.module+el8.3.0+6678+b09f589e RHSA-2026:88565
RHEL 8.4 EUS Long Life libzip +2 1.6.1-1.module+el8.3.0+6678+b09f589e RHSA-2026:88565
RHEL 8.4 EUS Long Life php +25 7.4.6-5.module+el8.4.0+25156+e0c98721.3 RHSA-2026:88565
RHEL 8.4 EUS Long Life php-pear 1:1.10.13-1.module+el8.4.0+16578+ed65e99e RHSA-2026:88565
RHEL 8.4 EUS Long Life php-pecl-rrd 2.0.1-1.module+el8.3.0+6678+b09f589e RHSA-2026:88565
RHEL 8.4 EUS Long Life php-pecl-xdebug 2.9.5-1.module+el8.3.0+6678+b09f589e RHSA-2026:88565
RHEL 8.4 EUS Long Life php-pecl-zip 1.18.2-1.module+el8.3.0+6678+b09f589e RHSA-2026:88565
RHEL 8.4 AUS apcu-panel +2 5.1.18-1.module+el8.3.0+6678+b09f589e RHSA-2026:88565
RHEL 8.4 AUS libzip +2 1.6.1-1.module+el8.3.0+6678+b09f589e RHSA-2026:88565
RHEL 8.4 AUS php +25 7.4.6-5.module+el8.4.0+25156+e0c98721.3 RHSA-2026:88565
RHEL 8.4 AUS php-pear 1:1.10.13-1.module+el8.4.0+16578+ed65e99e RHSA-2026:88565
RHEL 8.4 AUS php-pecl-rrd 2.0.1-1.module+el8.3.0+6678+b09f589e RHSA-2026:88565
RHEL 8.4 AUS php-pecl-xdebug 2.9.5-1.module+el8.3.0+6678+b09f589e RHSA-2026:88565
RHEL 8.4 AUS php-pecl-zip 1.18.2-1.module+el8.3.0+6678+b09f589e RHSA-2026:88565
Red Hat Hardened Images 1 php +26 8.5.12-1.hum1 RHSA-2026:87414

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 php +23 8.3.36-1.el10_2 ALSA-2026:87070
AlmaLinux 10 php8.4 +22 8.4.27-1.el10_2 ALSA-2026:87071
AlmaLinux 9 apcu-panel +2 5.1.23-1.module_el9.4.0+65+49ff6472 ALSA-2026:87079, ALSA-2026:87072
AlmaLinux 9 php +23 8.0.30-8.el9_8.1 ALSA-2026:A014, ALSA-2026:87151, ALSA-2026:87079
AlmaLinux 9 php-pecl-redis6 6.1.0-3.module_el9.8.0+257+89d727f2 ALSA-2026:87079
AlmaLinux 9 php-pecl-rrd 2.0.3-4.module_el9.4.0+65+49ff6472 ALSA-2026:87079, ALSA-2026:87072
AlmaLinux 9 php-pecl-xdebug3 3.2.2-2.module_el9.4.0+65+49ff6472 ALSA-2026:87079, ALSA-2026:87072
AlmaLinux 9 php-pecl-zip 1.22.3-1.module_el9.4.0+65+49ff6472 ALSA-2026:87079, ALSA-2026:87072
AlmaLinux 8 apcu-panel +2 5.1.18-1.module_el8.6.0+2750+78feabcb ALSA-2026:87080, ALSA-2026:87073
AlmaLinux 8 libzip +1 1.6.1-1.module_el8.6.0+2750+78feabcb ALSA-2026:87080, ALSA-2026:87073
AlmaLinux 8 libzip-tools 1.6.1-1.module_el8.6.0+3239+bedf0508 ALSA-2026:87080, ALSA-2026:87073
AlmaLinux 8 php +25 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 ALSA-2026:A013, ALSA-2026:A012, ALSA-2026:A011
AlmaLinux 8 php-ffi 7.4.33-8.module_el8.10.0+4321+cf5fd4bb ALSA-2026:A013, ALSA-2026:87080, ALSA-2026:87073
AlmaLinux 8 php-pear 1:1.10.13-1.module_el8.10.0+3935+28808425 ALSA-2026:87080, ALSA-2026:87073
AlmaLinux 8 php-pecl-rrd 2.0.1-1.module_el8.6.0+2750+78feabcb ALSA-2026:87080, ALSA-2026:87073
AlmaLinux 8 php-pecl-xdebug 2.9.5-1.module_el8.6.0+2750+78feabcb ALSA-2026:87080
AlmaLinux 8 php-pecl-xdebug3 3.2.2-2.module_el8.10.0+3796+30ed3ef7 ALSA-2026:87073
AlmaLinux 8 php-pecl-zip 1.18.2-1.module_el8.6.0+2750+78feabcb ALSA-2026:87080, ALSA-2026:87073

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 php 8.3.36-1.el10_2 RLSA-2026:87070
Rocky Linux 10 php8.4 8.4.27-1.el10_2 RLSA-2026:98609, RLSA-2026:87071
Rocky Linux 10 php8.4-gd +22 8.4.27-2.el10_3.1 RLSA-2026:98609
Rocky Linux 9 apcu-panel +1 5.1.27-2.module+el9.9.0+40326+676d2670 RLSA-2026:97880
Rocky Linux 9 php 8.0.30-8.el9_8.1 RLSA-2026:97880, RLSA-2026:87151, RLSA-2026:87079
Rocky Linux 9 php-gd +22 8.4.27-1.module+el9.9.0+40418+929a11b6 RLSA-2026:97880
Rocky Linux 9 php-pecl-apcu 5.1.23-1.module+el9.7.0+40004+bf50a568 RLSA-2026:97880, RLSA-2026:87079, RLSA-2026:87072
Rocky Linux 9 php-pecl-redis6 6.1.0-3.module+el9.8.0+40203+35cc8ffc RLSA-2026:97880, RLSA-2026:87079
Rocky Linux 9 php-pecl-rrd 2.0.3-4.module+el9.7.0+40003+454ed3c4 RLSA-2026:97880, RLSA-2026:87079, RLSA-2026:87072
Rocky Linux 9 php-pecl-xdebug3 3.2.2-2.module+el9.7.0+40004+bf50a568 RLSA-2026:97880, RLSA-2026:87079, RLSA-2026:87072
Rocky Linux 9 php-pecl-zip 1.22.3-1.module+el9.7.0+40004+bf50a568 RLSA-2026:97880, RLSA-2026:87079, RLSA-2026:87072
Rocky Linux 8 libzip 1.6.1-1.module+el8.10.0+1604+6558efc7 RLSA-2026:87080, RLSA-2026:87073
Rocky Linux 8 php 7.4.33-8.module+el8.10.0+40393+c071e357 RLSA-2026:87080, RLSA-2026:87073
Rocky Linux 8 php-pear 1:1.10.13-1.module+el8.10.0+1604+6558efc7 RLSA-2026:87080, RLSA-2026:87073
Rocky Linux 8 php-pecl-apcu 5.1.18-1.module+el8.10.0+1604+6558efc7 RLSA-2026:87080, RLSA-2026:87073
Rocky Linux 8 php-pecl-rrd 2.0.1-1.module+el8.4.0+414+2e7afcdd RLSA-2026:87080, RLSA-2026:87073
Rocky Linux 8 php-pecl-xdebug 2.9.5-1.module+el8.10.0+1604+6558efc7 RLSA-2026:87080
Rocky Linux 8 php-pecl-xdebug3 3.2.2-2.module+el8.10.0+1596+477f03f8 RLSA-2026:87073
Rocky Linux 8 php-pecl-zip 1.18.2-1.module+el8.10.0+1604+6558efc7 RLSA-2026:87080, RLSA-2026:87073

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 php7 +4 7.4.33-150400.4.81.1 SUSE-SU-2026:4853-1
SLES 15 SP7 php7-test 7.4.33-150400.4.81.2 SUSE-SU-2026:4853-1
SLES 15 SP7 php8 +5 8.3.36-150700.3.24.1 SUSE-SU-2026:4844-1
SLES 15 SP6 php7 +3 7.4.33-150400.4.81.1 SUSE-SU-2026:4853-1
SLES 15 SP6 php8 +5 8.2.35-150600.3.39.1 SUSE-SU-2026:4843-1
SLES 15 SP5 php7 +3 7.4.33-150400.4.81.1 SUSE-SU-2026:4853-1
SLES 15 SP5 php8 +4 8.0.30-150400.4.80.1 SUSE-SU-2026:4852-1
SLES 15 SP5 php8-test 8.0.30-150400.4.80.2 SUSE-SU-2026:4852-1
SLES 15 SP4 php7 +3 7.4.33-150400.4.81.1 SUSE-SU-2026:4853-1
SLES 15 SP4 php8 +4 8.0.30-150400.4.80.1 SUSE-SU-2026:4852-1
SLES 15 SP4 php8-test 8.0.30-150400.4.80.2 SUSE-SU-2026:4852-1
SLES 12 php74 7.4.33-1.74.1 SUSE-SU-2026:4870-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 php8 +4 8.4.27-160000.1.1 SUSE-SU-2026:24271-1
SLES for SAP 15 SP6 php7 +3 7.4.33-150400.4.81.1 SUSE-SU-2026:4853-1
SLES for SAP 15 SP6 php8 +5 8.2.35-150600.3.39.1 SUSE-SU-2026:4843-1
SLES for SAP 15 SP5 php7 +3 7.4.33-150400.4.81.1 SUSE-SU-2026:4853-1
SLES for SAP 15 SP5 php8 +4 8.0.30-150400.4.80.1 SUSE-SU-2026:4852-1
SLES for SAP 15 SP5 php8-test 8.0.30-150400.4.80.2 SUSE-SU-2026:4852-1
SLES for SAP 15 SP4 php7 +3 7.4.33-150400.4.81.1 SUSE-SU-2026:4853-1
SLES for SAP 15 SP4 php8 +4 8.0.30-150400.4.80.1 SUSE-SU-2026:4852-1
SLES for SAP 15 SP4 php8-test 8.0.30-150400.4.80.2 SUSE-SU-2026:4852-1
SLES 16.0 php8 +4 8.4.27-160000.1.1 SUSE-SU-2026:24271-1
SLE HPC 15 SP5 php8 +4 8.0.30-150400.4.80.1 SUSE-SU-2026:4852-1
SLE HPC 15 SP5 php8-test 8.0.30-150400.4.80.2 SUSE-SU-2026:4852-1
SLE HPC 15 SP4 php7 +3 7.4.33-150400.4.81.1 SUSE-SU-2026:4853-1
SLE HPC 15 SP4 php8 +4 8.0.30-150400.4.80.1 SUSE-SU-2026:4852-1
SLE HPC 15 SP4 php8-test 8.0.30-150400.4.80.2 SUSE-SU-2026:4852-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed matomo 5.14.2-1.1 openSUSE-SU-2026:12228-1
openSUSE Tumbleweed php8 8.5.12-1.1 openSUSE-SU-2026:12219-1
openSUSE Leap 16.0 php8 +5 8.4.27-160000.1.1 openSUSE-SU-2026:22151-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 php83 8.3.36-r0 —
Alpine v3.24 php84 8.4.27-r0 —
Alpine v3.24 php85 8.5.12-r0 —
Alpine v3.23 php83 8.3.36-r0 —
Alpine v3.23 php84 8.4.27-r0 —
Alpine v3.23 php85 8.5.12-r0 —
Alpine v3.22 php82 8.2.35-r0 —
Alpine v3.22 php83 8.3.36-r0 —
Alpine v3.22 php84 8.4.27-r0 —
Alpine v3.21 php82 8.2.35-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 php8.2 +27 8.2.35-1.amzn2023.0.1 ALAS2023-2026-3301
Amazon Linux 2023 php8.3 +28 8.3.36-1.amzn2023.0.1 ALAS2023-2026-3302
Amazon Linux 2023 php8.4 +27 8.4.27-1.amzn2023.0.1 ALAS2023-2026-3303
Amazon Linux 2023 php8.5 +26 8.5.12-1.amzn2023.0.1 ALAS2023-2026-3304

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 php +1 8.3.35-2 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 php +23 8.3.36-1.el10_2 ELSA-2026-87070
Oracle Linux 10 php8.4 +23 8.4.27-1.el10_2 ELSA-2026-87071
Oracle Linux 9 apcu-panel +2 5.1.23-1.module+el9.4.0+90261+af5cc950 ELSA-2026-87079, ELSA-2026-87072
Oracle Linux 9 php +23 8.0.30-8.el9_8.1 ELSA-2026-87151, ELSA-2026-87079, ELSA-2026-87072
Oracle Linux 9 php-pecl-redis6 6.1.0-3.module+el9.8.0+90982+92b8b4c7 ELSA-2026-87079
Oracle Linux 9 php-pecl-rrd 2.0.3-4.module+el9.4.0+90261+af5cc950 ELSA-2026-87079, ELSA-2026-87072
Oracle Linux 9 php-pecl-xdebug3 3.2.2-2.module+el9.4.0+90261+af5cc950 ELSA-2026-87079, ELSA-2026-87072
Oracle Linux 9 php-pecl-zip 1.22.3-1.module+el9.4.0+90261+af5cc950 ELSA-2026-87079, ELSA-2026-87072
Oracle Linux 8 apcu-panel +2 5.1.18-1.module+el8.10.0+90472+f810484b ELSA-2026-87080, ELSA-2026-87073
Oracle Linux 8 libzip +2 1.6.1-1.module+el8.10.0+90472+f810484b ELSA-2026-87080, ELSA-2026-87073
Oracle Linux 8 php +25 7.4.33-8.module+el8.10.0+91080+9785160d ELSA-2026-87080, ELSA-2026-87073
Oracle Linux 8 php-pear 1:1.10.13-1.module+el8.10.0+90472+f810484b ELSA-2026-87080, ELSA-2026-87073
Oracle Linux 8 php-pecl-rrd 2.0.1-1.module+el8.10.0+90472+f810484b ELSA-2026-87080, ELSA-2026-87073
Oracle Linux 8 php-pecl-xdebug 2.9.5-1.module+el8.10.0+90472+f810484b ELSA-2026-87080
Oracle Linux 8 php-pecl-xdebug3 3.2.2-2.module+el8.10.0+90469+8883f508 ELSA-2026-87073
Oracle Linux 8 php-pecl-zip 1.18.2-1.module+el8.10.0+90472+f810484b ELSA-2026-87080, ELSA-2026-87073

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling php-8.2 8.2.34-r4 —
Wolfi rolling php-8.3 8.3.35-r4 —
Wolfi rolling php-8.4 8.4.26-r4 —
Wolfi rolling php-8.5 8.5.11-r4 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 772 repositories · most starred shown

  • ikow/php2shell-poc ★ 1,967 · Oct 21, 2026

    CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.

  • eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC ★ 1,083 · Oct 21, 2026

    Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes on…

  • assetnote/php2shell-scanner ★ 1,003 · Oct 22, 2026

    High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)

  • devploit/php2shell ★ 297 · Oct 21, 2026

    CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.

  • JoasASantos/php2shell-exploit ★ 199 · Oct 22, 2026

    PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE

  • HOSTED-POWER/php_uploadprogress_guard ★ 173 · Oct 21, 2026

    Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. PHP…

  • syrex1013/php2shell ★ 154 · Oct 21, 2026

    CVE-2026-109618/109619 PoC — PHP session.upload_progress heap use-after-free (CVSS 9.2)

  • junaire/CVE-2026-109618-exploit ★ 143 · Oct 21, 2026
  • Anton-Barinov/php2shell-patches ★ 139 · Oct 21, 2026

    php2shell (CVE-2026-109618 & CVE-2026-109619) security patches for EOL PHP 5.4–8.1. Official & enhanced backports for vanilla php.net and Remi Collet trees. Restores safe file uploads & progress bars…

  • syhunt/php2shell-protection ★ 120 · Oct 21, 2026

    Defensive mitigation and testing toolkit for PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560), including Apache protections and PHP hardening guidance

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 50

References