PHP RCE exploit created before it was publicly published
CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), with a CVSS score of 9.2, allows remote code execution through memory corruption during out-of-memory (OOM) handling. CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), with a CVSS score of 9.2, allows remote code execution through stale global state
I want instead to create awareness of what is happening out there trying only part of the "weapons" that the bad guys are using.
Yesterday 21th of October I didn't have lunch since I was too fascinated by trying to find a famous PHP RCE exploit, on my own.
And... Spoiler, before it was publicly released by many folks around the globe, I already had it.
I want to underline how important is this topic. My aim was only for research but how if I was someone with less good intentions?
How if instead of having 5$ dollars of budget I had 500$ dollars?
Well, things could have gone very bad and most probably they are already going much worst out there.
Here my full research, enjoy.
