Skip to content
ThreatCluster

RCE Vulnerability in PHP 8.2–8.5 Disclosed

First seen 25 Oct 2026, 14:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 25, 2026 at 16:14 UTC
  • •CVE-2026-109618 affects PHP versions 8.2 to 8.5 with a CVSS score of 9.2.
  • •The vulnerability allows remote code execution via out-of-memory corruption.
  • •A proof-of-concept was released on October 23, increasing the urgency for patching.

A remote code execution vulnerability, CVE-2026-109618, was published on October 21, 2026, affecting PHP versions 8.2 to 8.5. The flaw arises from out-of-memory (OOM) corruption, allowing attackers to execute arbitrary code. A proof-of-concept (PoC) was made public on October 23, indicating potential exploitation risks. This vulnerability has a CVSS score of 9.2, categorizing it as. Users of PHP 8.2 to 8.5 are advised to apply patches immediately to mitigate risks. The vulnerability is currently not confirmed to be in the wild, but the existence of a PoC raises concerns about future attacks. PHP maintainers have been alerted, and updates are expected to be released shortly. Security professionals should prioritize patching affected systems to prevent possible exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109618 published
A critical RCE vulnerability affecting PHP versions 8.2 to 8.5 was disclosed.
Openwall
2026-10-23
First public PoC released
A proof-of-concept for CVE-2026-109618 was made publicly available, raising exploitation concerns.
Openwall

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (2)

1 / 2

Common questions

Which PHP versions are affected?
PHP versions 8.2 to 8.5 are affected by CVE-2026-109618.
Is there a patch available?
Patches are expected to be released soon; users should monitor for updates.
What should I do if I can't patch immediately?
Consider restricting access to affected systems and monitoring for unusual activity.