PHP2Shell · advisory

CVE-2026-109618

<?php$page = ["providers" => NVD · GHSA · KEV,"fetched" => per request,"provenance" => raw hash kept,"exploit_details" => never,];

VERIFYINGNo provider record found yet.

Official description

Critical vulnerabilities in the PHP runtime (php-src) in which certain fatal-error / out-of-memory paths could leave internal engine state unsafe for later request handling. (seed summary: provider record pending)

Severity: CRITICAL (seed)
CVSS: 9.2
Published: 2026-10-21 00:00:00Z
Modified: n/a

Affected packages / fixed versions

php 8.5.xfixed in 8.5.12
php 8.4.xfixed in 8.4.27
php 8.3.xfixed in 8.3.36
php 8.2.xfixed in 8.2.35

Agent activity

Patch · PR OPENREAL

showcase-projects/01-atlas-catalog/Dockerfile +7 more

php:8.4.26-fpm → php:8.4.27-fpm

CVE: CVE-2026-109618
Repository: VineetKamath/phpagent
PR: #2
Commit: f441fb0
CI: n/a
Opened: 2026-10-22 10:47:10Z
Merged: n/a
Time to patch: 1:12:08
Time to merge: n/a

Patch · PR OPENREAL

Dockerfile

php:8.3.35-apache → php:8.3.36-apache

CVE: CVE-2026-109618
Repository: Abel6448/08-haven-members
PR: #1
Commit: 72efc47
CI: n/a
Opened: 2026-10-22 10:30:26Z
Merged: n/a
Time to patch: 55:24
Time to merge: n/a

Patch · PR OPENREAL

docker-compose.yml

php:8.4.26-cli → php:8.4.27-cli

CVE: CVE-2026-109618
Repository: Abel6448/09-ledger-receipts
PR: #1
Commit: 164d704
CI: n/a
Opened: 2026-10-22 10:30:30Z
Merged: n/a
Time to patch: 55:28
Time to merge: n/a

Patch · PR OPENREAL

Dockerfile

php:8.2.34-fpm-alpine → php:8.2.35-fpm-alpine

CVE: CVE-2026-109618
Repository: Abel6448/10-orbit-status
PR: #1
Commit: f00b156
CI: n/a
Opened: 2026-10-22 10:30:34Z
Merged: n/a
Time to patch: 55:32
Time to merge: n/a

Patch · FAILEDREAL

.github/workflows/test.yml

php-version: '8.2.34' → php-version: '8.2.35'

CVE: CVE-2026-109618
Repository: Abel6448/06-quill-notes
PR: n/a
Commit: n/a
CI: 8/8 PASSING
Opened: n/a
Merged: n/a
Time to patch: n/a
Time to merge: n/a

Patch · FAILEDREAL

.github/workflows/verify.yml

php-version: "8.4.26" → php-version: "8.4.27"

CVE: CVE-2026-109618
Repository: Abel6448/07-pulse-queue
PR: n/a
Commit: n/a
CI: 8/8 PASSING
Opened: n/a
Merged: n/a
Time to patch: n/a
Time to merge: n/a