Skip to content
PHP CVE-2026-109618 Exploit Disclosed

PHP CVE-2026-109618 Exploit Disclosed

First seen 21 Oct 2026, 10:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 12:16 UTC
  • •CVE-2026-109618 affects PHP 8.x versions before 2026-10-21.
  • •The vulnerability allows unauthenticated remote code execution via crafted requests.
  • •Patches are available in PHP versions 8.2.35+ and 8.4.5+.

A vulnerability, CVE-2026-109618, affecting PHP versions 8.x prior to 2026-10-21 has been disclosed. The issue involves two heap use-after-free (UAF) bugs in the PHP session handling code, allowing unauthenticated attackers to execute arbitrary code via crafted requests. Affected systems are those running default configurations of PHP 8.x. The vulnerability has a CVSS score of 9.2, indicating a high severity level. A proof-of-concept (PoC) exploit has been released, and the vulnerability is actively being. PHP versions 8.2.35+ and 8.4.5+ contain patches for this issue. Users are advised to upgrade immediately to mitigate risks. The vulnerability was confirmed by multiple independent researchers.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 disclosed
Two heap UAF vulnerabilities in PHP session handling were reported, allowing remote code execution.
Sploitus
2026-10-21
Patches released
PHP versions 8.2.35+ and 8.4.5+ were released to address the critical vulnerabilities.
Sploitus

More articles in this cluster (4)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 4

Common questions

Which PHP versions are affected?
PHP versions 8.x prior to 2026-10-21 are affected by CVE-2026-109618.
Is there active exploitation of this vulnerability?
Yes, the vulnerability is actively being exploited in the wild according to multiple reports.
What should I do to protect my systems?
Upgrade to PHP versions 8.2.35+ or 8.4.5+ immediately to mitigate the risk.