PHP CVE-2026-109618

No authentication and no user interaction are required (PR:N/UI:N): the flaw is reached during PHP's automatic request body parsing before any application code executes. The confirmed exploitation path requires the Apache mod_php SAPI, which unconditionally runs the request shutdown procedure even after request startup fails, and was validated against default PHP input and memory limits with normal prefork, multi-worker configurations. The concrete trigger is a multipart/form-data request abusing multipart parsing (e.g. a multipart body without a usable declared content length that still supplies decoded data, an unbounded number of per-part headers that cost far more memory in PHP than on the wire, or empty file controls with nested field names) to drive the worker to OOM while request memory is only partially initialized. A predictable finite per-request memory_limit is what makes the OOM controllable. LIMITING FACTORS: reliability depends on PHP build, extensions, frontend behavior and allocator layout (AC:H/AT:P), and additional workers plus unrelated traffic can raise the number of attempts needed though they do not remove the condition. PHP-FPM exits the child on startup failure, which prevents the application-independent startup path and makes complete exploitation unproven for FPM (startup-independent OOM paths remain theoretically susceptible); FrankenPHP is likely susceptible like mod_php, and LSAPI is modeled on FPM with only likely, unvalidated application-specific exploits. Deployments that do not use multipart form data can block such requests at the frontend before they reach PHP.

This is a genuine top-priority vulnerability, not a high-CVSS paper tiger. The GHSA advisory confirms unauthenticated remote code execution as the web worker account, validated over HTTP against Apache mod_php using default PHP input and memory limits and normal prefork multi-worker configurations - i.e. out-of-the-box deployments, not an exotic edge case. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.2) agrees: network reach, no privileges, no user interaction, total confidentiality/integrity/availability impact. The AC:H and AT:P metrics reflect that exploit portability and reliability depend on the PHP build, extensions, frontend behavior and allocator layout, and that additional workers and unrelated traffic can increase the number of attempts required - the advisory grounds this explicitly rather than it being a race or timing assumption. A public exploit reference and a confirmed public PoC are present (vendor Ubuntu, wiz.io php2shell writeup, and a gist marked as exploit), and the vuln.today Decision label is act_now. The one conflicting signal is SSVC, which reports Exploitation: none and Automatable: no despite a confirmed public PoC and act_now label - treat the SSVC exploitation value as stale/conservative rather than as evidence of low risk, since the GHSA explicitly describes a confirmed working exploit. No EPSS score was provided, so probabilistic exploitation likelihood could not be weighed. The CVE is not listed in CISA KEV at time of analysis. SSVC Technical Impact: total is consistent with RCE. Net: for any internet-facing mod_php (and likely FrankenPHP) deployment this is an emergency-grade patch item.

An unauthenticated attacker sends a crafted multipart/form-data HTTP request to an Apache mod_php site that, during automatic request body parsing before any application code runs, drives the process into an out-of-memory condition while request memory is only partially initialized; the request shutdown procedure then operates on this invalid use-after-free state, giving remote code execution as the web worker account. A public PoC/exploit reference exists (confirmed), and the php2shell writeup documents the technique, so weaponization effort is low, though reliability varies with build, extensions, frontend and allocator layout and may require multiple attempts under load.