🚨New PHP Exploit Bypasses ASLR, Targets CVE-2026-109618

ASLR no longer stops PHP RCE exploits

A new exploit has been developed that bypasses ASLR protections to achieve remote code execution in PHP 8.4.26, targeting CVE-2026-109618. This exploit is a significant advance because it works on ASLR-enabled x86-64 systems with PHP's recommended production configuration. If you're running PHP in production, this is a major security concern as it means existing memory protections may not be enough to stop an attack. The PHP Foundation officially disclosed and issued patches for both CVE-2026-109618 and CVE-2026-109619 on Wednesday. The exploit also works on ARM64, but RCE is not currently functional on ARM-based systems. VulnCheck warns that threat actors are using AI to find even more ways to attack.