CVE-2026-109618
validatedZero produced an exploit or a check.GHSA-w8hw-w9fx-j79w ↗EUVD-2026-107260 ↗
check availableZero validated a working check for it.not proven exploitableZero has a detection check, but hasn't produced a full working exploit yet.
cve.orgpublic pocExploit code has been published by someone. Source signals can also carry a PoC (Proof of Concept).−18h32mkevAttacks confirmed in the real world.0d
PHP security team PHP < 8.2.35; < 8.3.36; < 8.4.27; < 8.5.12
fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12
ETK-2026-2243Zero's internal tracking ID, independent of the CVE number., permanent identifier
+4h19mTTV
51mAI analysisAnalysis: how long the AI spent reversing this signal.
Check if you are vulnerable description
Affected PHP deployments can retain invalid request-memory state after an out-of-memory failure. A remote unauthenticated attacker may be able to use this condition to execute code in the PHP process; exploitation requires reaching vulnerable request handling that triggers the out-of-memory path.
mitigation
Upgrade PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12, as applicable. Until upgrades are complete, restrict access to PHP-facing services and apply resource limits and monitoring to reduce exposure to abnormal memory-exhaustion requests.
fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12
check
available
exploit
no
automationDeterministic: a check that runs on its own, the same request on every target. Contextual: an agentic technique that needs to be applied per target, for bugs that depend on contextual flows.
contextual
auth requiredWhether an attacker needs an account first, based on the CVSS vector's Privileges Required.
no
EPSSEstimate of the chance this CVE is exploited in the next 30 days. Refreshed daily.
–
agent run time
51m
cve.org record, t = 0The moment cve.org publishes the CVE in full.
2026-10-21 13:48Z
Δ to public pocExploit code has been published by someone. Source signals can also carry a PoC (Proof of Concept).
−18h32m
Δ to kevAttacks confirmed in the real world.
0d
outcome
Contextual check: a technique exists and was validated, but no deterministic check could cover this one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-20 20:56Zbleepingcomputer: trigger signal, started the run
- 2026-10-20 20:56ZPHP warns admins of two critical flaws, emergency patches coming tomorrow
- 2026-10-21 00:00Z
- 2026-10-21 06:18ZZer061/CVE-2026-109618
- 2026-10-21 13:48Zcve.org record for CVE-2026-109618
- 2026-10-21 14:07ZPHP ships emergency patches for critical PHP2Shell flaws
- 2026-10-21 18:08Zdinosn/php-cve-2026-10961x-lab-poc
- 2026-10-22 13:09ZAmazon says PHP2Shell exploitation began 4 days before patches
this entry in the feed
GET /api/v1/feed/CVE-2026-109618
{ "etk_id": "ETK-2026-2243", "cve_id": "CVE-2026-109618", "display_id": "CVE-2026-109618", "ghsa_id": "GHSA-w8hw-w9fx-j79w", "euvd_id": "EUVD-2026-107260", "status": "published", "anchor_state": "anchored", "title": "PHP out-of-memory cleanup memory-safety flaw", "summary": "Affected PHP deployments can retain invalid request-memory state after an out-of-memory failure. A remote unauthenticated attacker may be able to use this condition to execute code in the PHP process; exploitation requires reaching vulnerable request handling that triggers the out-of-memory path.", "mitigation": "Upgrade PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12, as applicable. Until upgrades are complete, restrict access to PHP-facing services and apply resource limits and monitoring to reduce exposure to abnormal memory-exhaustion requests.", "vendor": "PHP security team", "product": "PHP", "affected": [ { "affected_notes": [], "affected_ranges": [ "< 8.2.35" ], "ecosystem": "php", "fixed_versions": [ "8.2.35" ], "package_name": "php-src", "purl": null }, { "affected_notes": [], "affected_ranges": [ "< 8.3.36" ], "ecosystem": "php", "fixed_versions": [ "8.3.36" ], "package_name": "php-src", "purl": null }, { "affected_notes": [], "affected_ranges": [ "< 8.4.27" ], "ecosystem": "php", "fixed_versions": [ "8.4.27" ], "package_name": "php-src", "purl": null }, { "affected_notes": [], "affected_ranges": [ "< 8.5.12" ], "ecosystem": "php", "fixed_versions": [ "8.5.12" ], "package_name": "php-src", "purl": null } ], "cwes": null, "cvss_score": 9.2, "cvss_src": "other", "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "contextual", "check": true, "check_confidence_basis": "assessed", "exploit": false, "pipeline_minutes": 51.101801816666665, "t0_at": "2026-10-21T13:48:34.845000+00:00", "signals": { "check": { "at": "2026-10-21T18:07:49.583617+00:00", "days": 0.1800316969560185, "is_lower_bound": false, "measured_at": "2026-10-21T13:48:34.845000+00:00", "url": null }, "kev": { "at": "2026-10-21T00:00:00+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-21T13:48:34.845000+00:00", "precision": "day", "url": "https://vulncheck.com/cve/CVE-2026-109618" }, "public_poc": { "at": "2026-10-20T19:16:47+00:00", "days": -0.7720815393518519, "is_lower_bound": false, "measured_at": "2026-10-21T13:48:34.845000+00:00", "url": "https://github.com/dinosn/php-cve-2026-10961x-lab-poc" }, "trigger_signal": { "at": "2026-10-20T20:56:43+00:00", "days": -0.7026833912037037, "is_lower_bound": false, "measured_at": "2026-10-21T13:48:34.845000+00:00", "url": "https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/" } } }
published 2026-10-21 00:23Z
last change 2026-10-22 14:06Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.