Skip to content
Critical PHP Memory Allocation Flaw Exposed with PoC

Critical PHP Memory Allocation Flaw Exposed with PoC

First seen 22 Oct 2026, 07:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 09:14 UTC
  • •CVE-2026-109618 allows RCE in PHP versions before 8.2.35.
  • •Public PoC code demonstrates exploitation methods for the vulnerability.
  • •The flaw was patched on October 21, 2026; immediate updates are recommended.

A critical vulnerability in PHP, identified as CVE-2026-109618, was disclosed on October 21, 2026, with a CVSS score of 9.2. This flaw allows for remote code execution (RCE) through improperly controlled sequential memory allocation in the upload-progress handler. The vulnerability affects PHP versions prior to 8.2.35, with proof-of-concept (PoC) code released publicly. Attackers can exploit this flaw by sending specially crafted requests that trigger object destructors, executing arbitrary commands on the server. The vulnerability was successfully tested on PHP version 8.2.34 but is blocked in 8.2.35 due to an added security measure. The patch for this vulnerability was also released on October 21, 2026. Security professionals are urged to update their PHP installations to mitigate the risk of exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 published
A critical vulnerability in PHP was disclosed, allowing for remote code execution through memory allocation issues.
Sploitus
2026-10-21
Patch released
PHP released a patch addressing the vulnerability, urging users to update to version 8.2.35 or later.
Sploitus
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (10)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 4

Common questions

Which PHP versions are affected?
PHP versions prior to 8.2.35 are affected by CVE-2026-109618.
What is the risk of exploitation?
The vulnerability allows for remote code execution, making it critical for server security.
How should I mitigate this vulnerability?
Update PHP to version 8.2.35 or later immediately to apply the patch.