What’s Vulnerable › Vulnerabilities

CVE-2026-109618: RCE via OOM corruption

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-10-26
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-10-21 · updated 2026-10-26
• Weakness: CWE-416

Description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Summary

CVE-2026-109618 is a critical (CVSS 9.8) remote code execution flaw in PHP's out-of-memory handling: longjmp() can leave request memory uninitialized before an allocation, and request cleanup may then read or branch on that memory, allowing RCE. Affected products include PHP (fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12), Palo Alto Networks PAN-OS (fixed in 10.2.7, 11.1.4, 11.2.4, 12.1.4), Panorama Virtual Appliance, and Siemens Ruggedcom Ape1808 Firmware. It is listed in CISA's Known Exploited Vulnerabilities catalog and a public exploit or detection template exists, with EPSS at 100.0%. Apply the vendor fixes or mitigations per CISA BOD 26-04 guidance, and discontinue use of affected products where mitigations are unavailable.

تُعدّ CVE-2026-109618 ثغرة تنفيذ تعليمات برمجية عن بُعد (RCE) حرجة بدرجة 9.8 في معالجة نفاد الذاكرة (OOM) في PHP؛ إذ قد يترك longjmp() ذاكرة الطلب غير مهيأة قبل التخصيص، ثم تقرأ إجراءات التنظيف هذه الذاكرة أو تتفرّع بناءً عليها، ما يتيح تنفيذ تعليمات برمجية عن بُعد. تشمل المنتجات المتأثرة PHP (تم إصلاحها في 8.2.35 و8.3.36 و8.4.27 و8.5.12)، وPalo Alto Networks PAN-OS (تم إصلاحها في 10.2.7 و11.1.4 و11.2.4 و12.1.4)، وPanorama Virtual Appliance، وSiemens Ruggedcom Ape1808 Firmware. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة الاستغلال، ويوجد استغلال عام أو قالب كشف، مع احتمال استغلال EPSS بنسبة 100.0%. طبّق إصلاحات المورّد أو التخفيفات وفق إرشادات CISA BOD 26-04، وأوقف استخدام المنتجات المتأثرة إذا لم تتوفر التخفيفات.

Affected products

• Palo Alto Networks PAN-OS: from 10.2.0 before 10.2.7; from 11.1.0 before 11.1.4; from 11.2.0 before 11.2.4; from 12.1.0 before 12.1.4; from 12.2.0 before 12.2.4; 10.2.7, 10.2.7-h1, 10.2.7-h10, 10.2.7-h11, 10.2.7-h12, 10.2.7-h13 (+279) — fixed in 10.2.7, 11.1.4, 11.2.4, 12.1.4, 12.2.4
• Paloaltonetworks Panorama Virtual Appliance: all versions
• PHP: from 7.3.0 before 8.2.35; from 8.3.0 before 8.3.36; from 8.4.0 before 8.4.27; from 8.5.0 before 8.5.12 — fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12
• Siemens Ruggedcom Ape1808 Firmware: all versions

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.2.7, 11.1.4, 11.2.4, 12.1.4; PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12. Check the vendor advisory for mitigations.

In the news

• 2026-018: Critical Vulnerabilities in PHP
• Vulnerabilities in PHP Affecting Cisco Products: October 2026
• Discover and remediate PHP2Shell exposure with Tenable
• Industrial Vendors Check Products for PHP2Shell Vulnerabilities
• PHP2Shell Exploitation Moves From Probes to Working Shells
• CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)
• PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
• Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)

References

• https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• http://www.openwall.com/lists/oss-security/2026/10/21/6
• http://www.openwall.com/lists/oss-security/2026/10/23/5
• https://cert-portal.siemens.com/productcert/html/ssa-566512.html
• https://www.wiz.io/blog/php2shell-php-rce

Get alerted when CVE-2026-109618 or the next vulnerability affects your stack