CVE-2026-109618 is a critical-severity vulnerability. AttackerView checks PHP sites for it with a live exploit check.
Detects PHP installations where running out of memory mid request leaves the engine's own session state pointing at memory it has already handed back. PHP parses file upload bodies before any application code runs, and its upload progress feature starts a session inside that early window. When memory runs out there, PHP jumps straight out of the request without finishing the cleanup, so the pointer to the session id outlives the memory it referred to and the next request served by the same worker reads it. Wiz Research, who named this php2shell, turned that into unauthenticated reading of worker memory, where passwords, tokens and API keys belonging to other visitors live, and then into remote code execution before login on WordPress, Drupal and Joomla. The flaw is in PHP itself, so an application with no bug of its own is still affected. The check is three ordinary upload requests on one connection: the first proves the server hands out a session cookie, the second exhausts the memory limit while the body is still being parsed, and the third repeats the first request byte for byte. A patched PHP returns the same session cookie it returned before. Losing it means request state outlived the request. The request body is capped at 2 MB, so a server with a memory limit that cap cannot reach is reported as not vulnerable rather than pushed any harder. The three requests only prove anything if one worker served all of them, which Apache mod_php demonstrates through its Keep-Alive request counter. On nginx with php-fpm, and behind a reverse proxy, that cannot be shown, so the check reports the host as not tested and sends no memory-exhausting request at all rather than reporting a clean result it cannot stand behind. Measured: detected on every run against Apache mod_php 8.3.35, never on patched 8.3.36, and reported as not tested against a vulnerable php-fpm host. CVSS 9.8. Upgrade PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12; the PHP security team states updating is the only complete fix. Note that Linux distributions ship this fix without changing the version PHP reports, so a version number is not a reliable answer either way.
Is your app exploitable through CVE-2026-109618?
Scan your domain free