PHP OOM handler RCE exploited in the wild (CVE-2026-109618) [PoC]

Actively exploited in the wild - CVE-2026-109618 is a critical remote code execution flaw in PHP’s out-of-memory (OOM) error handling that grants unauthenticated attackers code execution on affected servers. Patched releases are available; treat any internet-facing PHP deployment as exposed until updated.

Overview

PHP handles memory exhaustion by calling longjmp() to unwind out of the current execution context and abort the request. Some internal code paths do not correctly account for this jump. When an OOM occurs at the wrong moment, request-scoped memory can be left uninitialized before a subsequent allocation, and the request cleanup routine may later read or branch on that stale memory. Attackers can drive several different OOM strategies to trigger the condition reliably.

The result is memory corruption during request teardown that can be shaped into remote code execution. Because the flaw sits in core request handling, it applies broadly: PHP-FPM pools, mod_php deployments, and any application that surfaces PHP to untrusted input. No authentication or user interaction is required, and the attack is delivered over the network with low complexity, which is why this scores 9.8 and why exploit activity is already confirmed.

Impact

A successful attack lets an unauthenticated remote attacker run arbitrary code as the web server user and pivot from there. Given how common PHP is across CMS platforms, APIs, and shared hosting, the blast radius is large. An attacker who lands code execution can read application secrets and database credentials, tamper with content, and move laterally inside the hosting environment. Any multi-tenant hosting provider running a vulnerable PHP build should assume that tenant isolation is at risk. Data breach reports are available at breach reports and ongoing coverage at security news.

Remediation and Mitigation

Update PHP to the latest patched release for your branch as a first priority, and do not rely on a single version number - check the vendor’s release notes for the fixed builds across every maintained line. If you cannot patch immediately:

• Reduce OOM trigger surface by capping memory_limit conservatively and rejecting oversized request bodies at the reverse proxy.
• Put PHP-FPM pools behind strict per-pool resource limits so a single triggered OOM cannot cascade.
• Restrict direct internet exposure of PHP error output and diagnostic endpoints.
• Hunt for anomalous request patterns that induce repeated memory exhaustion, which is a strong precursor signal for this exploit.

Confirm your package manager or container base image actually ships the patched build; many images lag upstream releases by weeks.

Security Insight

This bug is a textbook example of why control-flow primitives like longjmp() are a liability in garbage-collected runtimes: they skip the normal unwinding that keeps memory state consistent. PHP’s OOM handler has been a source of subtle defects for years, and the fact that multiple trigger strategies produce the same corruption suggests the faulty pattern exists in more than one code path rather than a single missed check. For defenders, the takeaway is that core interpreter flaws defeat the perimeter entirely - the WAF does not see a malicious payload, only a request that runs out of memory.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs