CVEvulnerability

CVE-2026-109618

9.2 CRITICAL Known exploited Published 2026-10-21 Modified 2026-10-29 Official page ↗

CISA Known Exploited Vulnerability

PHP Memory Corruption Vulnerability — PHP Group PHP

PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.

Added to KEV
2026-10-26
Remediation due
2026-10-29
Ransomware use
Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109618
Status
Analyzed
Published
2026-10-21
Last modified
2026-10-29
Assigner
[email protected]
CVSS 4.0 ([email protected])
9.2 CRITICAL — CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1325, CWE-416, CWE-755, CWE-824

Description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Affected configurations

• php php (>= 7.3.0 < 8.2.35) • php php (>= 8.3.0 < 8.3.36) • php php (>= 8.4.0 < 8.4.27) • php php (>= 8.5.0 < 8.5.12) • siemens ruggedcom ape1808 firmware • paloaltonetworks pan-os (>= 10.2.0 < 10.2.7) • paloaltonetworks pan-os 10.2.7 • paloaltonetworks pan-os 10.2.8 • paloaltonetworks pan-os 10.2.9 • paloaltonetworks pan-os 10.2.10 • paloaltonetworks pan-os 10.2.11 • paloaltonetworks pan-os 10.2.12 • paloaltonetworks pan-os 10.2.13 • paloaltonetworks pan-os 10.2.14 • paloaltonetworks pan-os 10.2.15 • paloaltonetworks pan-os 10.2.16 • paloaltonetworks pan-os 10.2.17 • paloaltonetworks pan-os 10.2.18 • paloaltonetworks pan-os (>= 11.1.0 < 11.1.4) • paloaltonetworks pan-os 11.1.4 • paloaltonetworks pan-os 11.1.5 • paloaltonetworks pan-os 11.1.6 • paloaltonetworks pan-os 11.1.7 • paloaltonetworks pan-os 11.1.8 • paloaltonetworks pan-os 11.1.9 • paloaltonetworks pan-os 11.1.10 • paloaltonetworks pan-os 11.1.11 • paloaltonetworks pan-os 11.1.12 • paloaltonetworks pan-os 11.1.13 • paloaltonetworks pan-os 11.1.14 • paloaltonetworks pan-os 11.1.15 • paloaltonetworks pan-os 11.1.16 • paloaltonetworks pan-os (>= 11.2.0 < 11.2.4) • paloaltonetworks pan-os 11.2.4 • paloaltonetworks pan-os 11.2.5 • paloaltonetworks pan-os 11.2.6 • paloaltonetworks pan-os 11.2.7 • paloaltonetworks pan-os 11.2.8 • paloaltonetworks pan-os 11.2.9 • paloaltonetworks pan-os 11.2.10 • paloaltonetworks pan-os 11.2.11 • paloaltonetworks pan-os 11.2.12 • paloaltonetworks pan-os 11.2.13 • paloaltonetworks pan-os 11.2.15 • paloaltonetworks pan-os 11.2.16 • paloaltonetworks pan-os (>= 12.1.0 < 12.1.4) • paloaltonetworks pan-os 12.1.4 • paloaltonetworks pan-os 12.1.5 • paloaltonetworks pan-os 12.1.6 • paloaltonetworks pan-os 12.1.7 • paloaltonetworks pan-os 12.1.8 • paloaltonetworks pan-os 12.1.9 • paloaltonetworks pan-os 12.1.10 • paloaltonetworks pan-os (>= 12.2.0 < 12.2.4) • paloaltonetworks pan-os 12.2.4 • paloaltonetworks pan-os • paloaltonetworks panorama virtual appliance

Related

Weakness · CWE (4)

  • CWE-1325 Improperly Controlled Sequential Memory Allocation weakness
  • CWE-416 Use After Free weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness
  • CWE-824 Access of Uninitialized Pointer weakness

References