CVE-2026-109618: PHP Memory Corruption Leads to Unauthenticated RCE

Overview

This report details CVE-2026-109618, a critical memory corruption vulnerability in PHP that enables unauthenticated remote code execution. The flaw stems from improper handling of out-of-memory errors, leaving request memory in an uninitialized state. Active exploitation has been observed, with threat actors leveraging this vulnerability to deploy various malware families and establish persistence.

Technical Analysis

The vulnerability, CVE-2026-109618, is an out-of-memory (OOM) corruption flaw in PHP. It occurs because PHP uses longjmp() to exit the current context during OOM errors, but some contexts fail to properly account for this, leaving request memory uninitialized. Subsequent request cleanup procedures can then read or branch on this uninitialized memory, leading to remote code execution (RCE). The vulnerability is unauthenticated and can be triggered consistently via multiple OOM strategies.

• CVSS 3.1 Score: 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
• Weaknesses: CWE-416 (Use-After-Free), CWE-755 (Improper Handling of Exceptional Conditions), CWE-824 (Access of Uninitialized Pointer), CWE-1325 (Uninitialized Memory in PHP).
• Affected PHP versions:
  • php >= 7.3.0 < 8.2.35
  • php >= 8.3.0 < 8.3.36
  • php >= 8.4.0 < 8.4.27
  • php >= 8.5.0 < 8.5.12
• Affected products also include:
  • siemens ruggedcom_ape1808_firmware
  • paloaltonetworks pan-os >= 10.2.0 < 10.2.7
  • paloaltonetworks pan-os 10.2.7
  • paloaltonetworks pan-os 10.2.8
  • paloaltonetworks pan-os 10.2.9
  • paloaltonetworks pan-os 10.2.10

Detection

• Monitor web server access logs for unusual request patterns, especially those that might trigger OOM conditions or attempt to execute arbitrary commands. Look for abnormally long or malformed requests.
• Monitor for unexpected child processes spawned by web server processes (e.g., httpd.exe, nginx.exe, php-fpm.exe, php.exe). Look for cmd.exe, powershell.exe, sh, bash, python.exe, or other scripting interpreters.
• Look for suspicious file writes in web-accessible directories, such as .php files with obfuscated content or known webshell signatures, originating from web server processes.
• Analyze system logs for php process crashes or abnormal memory usage spikes followed by suspicious process activity.
• Hunt for network connections initiated by the web server process to unusual external IP addresses or domains, indicative of C2 communication or data exfiltration.

Sigma Detection Rules

Windows Web Server Spawning Shell

title: Windows Web Server Spawning Shell
id: 9a3e2f1a-b1c7-4d8e-a0b1-c74d8ea0b1c7
status: experimental
description: Detects suspicious shell process creation by common Windows web server processes, indicative of RCE.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\inetinfo.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\php-fpm.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
level: high

Linux Web Server Spawning Shell

title: Linux Web Server Spawning Shell
id: 8b2d1e0a-a0b1-4c7d-8e9f-a0b1c74d8e9f
status: experimental
description: Detects suspicious shell process creation by common Linux web server processes, indicative of RCE.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    ParentProcessName:
      - 'apache2'
      - 'httpd'
      - 'nginx'
      - 'php-fpm'
      - 'php-cgi'
    ProcessName:
      - 'sh'
      - 'bash'
      - 'dash'
      - 'zsh'
      - 'python'
      - 'perl'
      - 'php'
  condition: selection
level: high

PHP Process Outbound Network Connection

title: PHP Process Outbound Network Connection
id: 7c1f0d9a-9f8e-4b6c-7d5a-9f8e4b6c7d5a
status: experimental
description: Detects outbound network connections initiated by PHP processes to non-standard ports or external IPs, potentially indicating C2 or data exfiltration after RCE.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 3
    Image|endswith:
      - '\php.exe'
      - '\php-cgi.exe'
      - '\php-fpm.exe'
    DestinationPort|!in:
      - 80
      - 443
    DestinationIp|!in:
      - '127.0.0.1'
      - '::1'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection
level: medium

Mitigations

1. Patch PHP installations immediately. Upgrade to the latest patched versions: PHP 8.2.35, PHP 8.3.36, PHP 8.4.27, PHP 8.5.12, or newer.
2. Apply available patches for affected products such as Siemens RUGGEDCOM APE1808 firmware and Palo Alto Networks PAN-OS.
3. Implement a Web Application Firewall (WAF) to detect and block malicious request patterns targeting PHP vulnerabilities.
4. Restrict outbound network connectivity from web servers to only necessary services and destinations.
5. Employ Endpoint Detection and Response (EDR) solutions to monitor for suspicious process creation and file modifications on web servers.

References

• https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• http://www.openwall.com/lists/oss-security/2026/10/21/6
• http://www.openwall.com/lists/oss-security/2026/10/23/5
• https://cert-portal.siemens.com/productcert/html/ssa-566512.html
• https://www.wiz.io/blog/php2shell-php-rce
• https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-glocal-php-infrastructure/
• https://hunt.io/blog/php2shell-cve-2026-109618-109619-open-directories
• https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
• https://www.vulncheck.com/blog/php2shell-vulnerabilities
• https://socradar.io/blog/inc-gentlemen-ransomware-ai-infrastructure
• https://www.huntress.com/blog/amazon-clickfix-finger
• https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/
• https://www.security.nl/posting/959207/Amerikaanse+overheid+waarschuwt+voor+misbruik+van+PHP2Shell-lekken?channel=rss

Indicators of Compromise

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application
• T1059.004 — Unix Shell
• T1059.003 — Windows Command Shell
• T1059.006 — Python
• T1059.001 — PowerShell
• T1505.003 — Web Shell
• T1590.005 — IP Addresses
• T1053.003 — Cron
• T1005 — Data from Local System
• T1608.001 — Upload Malware
• T1595.002 — Vulnerability Scanning
• T1583.004 — Server
• T1098.004 — SSH Authorized Keys
• T1552.001 — Credentials In Files
• T1041 — Exfiltration Over C2 Channel
• T1210 — Exploitation of Remote Services
• T1486 — Data Encrypted for Impact
• T1496 — Resource Hijacking
• T1105 — Ingress Tool Transfer
• T1588.005 — Exploits
• T1592 — Gather Victim Host Information
• T1133 — External Remote Services
• T1071.004 — DNS
• T1036.005 — Match Legitimate Resource Name or Location
• T1499.004 — Application or System Exploitation
• T1071 — Application Layer Protocol
• T1036 — Masquerading
• T1595 — Active Scanning
• T1090.002 — External Proxy
• T1090 — Proxy
• T1059 — Command and Scripting Interpreter
• T1078 — Valid Accounts
• T1573 — Encrypted Channel
• T1592.002 — Software
• T1203 — Exploitation for Client Execution
• T1499 — Endpoint Denial of Service
• T1071.001 — Web Protocols
• T1046 — Network Service Discovery
• T1082 — System Information Discovery
• T1583.003 — Virtual Private Server
• T1102 — Web Service
• T1562.001 — Disable or Modify Tools
• T1070.004 — File Deletion
• T1021 — Remote Services
• T1083 — File and Directory Discovery
• T1136 — Create Account
• T1018 — Remote System Discovery
• T1003.003 — NTDS
• T1021.001 — Remote Desktop Protocol
• T1567.002 — Exfiltration to Cloud Storage
• T1587.001 — Malware
• T1489 — Service Stop
• T1087.002 — Domain Account
• T1053.005 — Scheduled Task
• T1219 — Remote Access Tools
• T1558.003 — Kerberoasting
• T1583.001 — Domains
• T1135 — Network Share Discovery
• T1588.002 — Tool
• T1490 — Inhibit System Recovery
• T1110 — Brute Force
• T1204.002 — Malicious File
• T1114.001 — Local Email Collection
• T1572 — Protocol Tunneling
• T1021.002 — SMB/Windows Admin Shares
• T1072 — Software Deployment Tools
• T1566.001 — Spearphishing Attachment
• T1070.006 — Timestomp
• T1074.001 — Local Data Staging
• T1555.003 — Credentials from Web Browsers
• T1056.002 — GUI Input Capture
• T1003.006 — DCSync
• T1057 — Process Discovery
• T1591 — Gather Victim Org Information
• T1056.001 — Keylogging
• T1555 — Credentials from Password Stores
• T1132.001 — Standard Encoding
• T1566.002 — Spearphishing Link
• T1573.001 — Symmetric Cryptography
• T1218.011 — Rundll32
• T1497.001 — System Checks
• T1539 — Steal Web Session Cookie
• T1027 — Obfuscated Files or Information
• T1102.002 — Bidirectional Communication
• T1140 — Deobfuscate/Decode Files or Information
• T1055.012 — Process Hollowing
• T1110.001 — Password Guessing
• T1087.001 — Local Account
• T1021.004 — SSH
• T1040 — Network Sniffing
• T1567 — Exfiltration Over Web Service
• T1552 — Unsecured Credentials
• T1552.004 — Private Keys
• T1087 — Account Discovery
• T1087.004 — Cloud Account