What is the CVSS score and severity of CVE-2026-109618?

CVE-2026-109618 is rated CRITICAL with a CVSS score of 9.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-122 (Heap-based Buffer Overflow).

CVE-2026-109618 CRITICAL · CVSS 9.2 · The PHP Group — PHP Engine (SAPI Multipart Parser) · 2026-10-27

CVE-2026-109618: PHP SAPI Multipart Parser (php2shell)

Q: What versions are affected by CVE-2026-109618?

CVE-2026-109618 affects PHP < 8.5.12, < 8.4.27 (8.4.x < 8.4.6), < 8.3.36 (8.3.x < 8.3.19), < 8.2.35 (8.2.x < 8.2.28) in PHP Engine (SAPI Multipart Parser) (PHP SAPI Multipart Parser (php2shell)).

Q: How do I patch or remediate CVE-2026-109618?

To remediate CVE-2026-109618, upgrade to the patched release: PHP 8.5.12, 8.4.27 (8.4.6), 8.3.36 (8.3.19), 8.2.35 (8.2.28). Upgrade PHP runtimes to patched maintenance releases (PHP 8.5.12, 8.4.27 / 8.4.6, 8.3.36 / 8.3.19, or 8.2.35 / 8.2.28) and restart php-fpm workers. Enforce strict WAF multipart boundary length and header count limits at the edge proxy for endpoints that do not accept file uploads. Verify container base images (php:fpm-alpine / debian) are rebuilt against the latest October 2026 upstream packages.

Known as "php2shell", this pre-authentication heap buffer corruption in rfc1867 multipart/form-data boundary parsing triggers before application PHP scripts execute, enabling remote code execution on exposed PHP-FPM and Apache mod_php endpoints.

Identifier

CVE-2026-109618

Vendor / Product

The PHP Group · PHP Engine (SAPI Multipart Parser)

Severity / CVSS

CRITICAL · CVSS 9.2

Vector / CWE

CWE-122 (Heap-based Buffer Overflow)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected

PHP < 8.5.12, < 8.4.27 (8.4.x < 8.4.6), < 8.3.36 (8.3.x < 8.3.19), < 8.2.35 (8.2.x < 8.2.28)

Patched Version

PHP 8.5.12, 8.4.27 (8.4.6), 8.3.36 (8.3.19), 8.2.35 (8.2.28)

Priority

P0 — Emergency PHP Runtime Upgrade

Executive Summary & Technical Impact

Tracked under CVE-2026-109618 (CWE-122 (Heap-based Buffer Overflow)), this vulnerability affects PHP < 8.5.12, < 8.4.27 (8.4.x < 8.4.6), < 8.3.36 (8.3.x < 8.3.19), < 8.2.35 (8.2.x < 8.2.28) and carries a severity score of 9.2 (CRITICAL). Engineering and security operations teams running PHP Engine (SAPI Multipart Parser) should prioritize upgrading to PHP 8.5.12, 8.4.27 (8.4.6), 8.3.36 (8.3.19), 8.2.35 (8.2.28).

Remediation & Patch Guidance

Upgrade PHP runtimes to patched maintenance releases (PHP 8.5.12, 8.4.27 / 8.4.6, 8.3.36 / 8.3.19, or 8.2.35 / 8.2.28) and restart php-fpm workers.
Enforce strict WAF multipart boundary length and header count limits at the edge proxy for endpoints that do not accept file uploads.
Verify container base images (php:fpm-alpine / debian) are rebuilt against the latest October 2026 upstream packages.

Frequently Asked Questions (CVE-2026-109618)

What versions are affected by CVE-2026-109618?

CVE-2026-109618 affects PHP < 8.5.12, < 8.4.27 (8.4.x < 8.4.6), < 8.3.36 (8.3.x < 8.3.19), < 8.2.35 (8.2.x < 8.2.28) in PHP Engine (SAPI Multipart Parser) (PHP SAPI Multipart Parser (php2shell)).

How do I patch or remediate CVE-2026-109618?

Upgrade affected deployments to PHP 8.5.12, 8.4.27 (8.4.6), 8.3.36 (8.3.19), 8.2.35 (8.2.28) and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-109618?

CVE-2026-109618 is rated CRITICAL with a CVSS score of 9.2 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Full TechPulse Investigation

PHP2Shell (CVE-2026-109618): Pre-Auth RCE Threatening 70% of the Web Discovered by GPT-5.6 Sol

How security researchers at Calif used OpenAI's GPT-5.6 Sol under the Patch the Planet initiative to uncover the most critical PHP remote code execution flaw of the year.

Read full engineering post-mortem (8 min read) →