CVE-2026-109618
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Executive briefing
The source record describes: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). The practical risk depends on whether an affected product/version is present, reachable and configured in an exploitable way. Review the affected-product evidence and linked vendor advisories before assigning exposure status.
Evidence confidence: Moderate Evidence-derived, not an exploitability verdict
Severity & attack characteristics
CVSS vector:CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CISA KEV: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Technical explanation & impact
The technical mechanism is not expanded beyond the source description unless a referenced advisory supplies additional evidence. Read the linked vendor/CERT advisories for root-cause detail.
Potential impact must be interpreted from the published CVSS impact metrics and the affected component. A CVSS impact score is not proof that a particular asset is exploitable.
Weakness classification
CWE-416CWE-755CWE-824CWE-1325Affected products and versions
Products below are parsed from NVD vulnerable CPE configuration entries. Version boundaries are shown as published; verify applicability with the vendor.
| Vendor | Product | Version evidence |
|---|---|---|
| php | php | from (inclusive) 8.5.0; before 8.5.12 |
| siemens | ruggedcom_ape1808_firmware | Version not specified in CPE |
| paloaltonetworks | pan-os | from (inclusive) 12.2.0; before 12.2.4 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.8 · CPE version 10.2.9 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.11 · CPE version 10.2.12 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.14 · CPE version 10.2.15 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.17 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.5 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.8 · CPE version 11.1.9 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.11 · CPE version 11.1.12 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.14 · CPE version 11.1.15 · CPE version 11.1.16 · CPE version 11.1.16 · CPE version 11.1.16 · CPE version 11.1.16 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.5 · CPE version 11.2.6 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.8 · CPE version 11.2.9 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.11 · CPE version 11.2.12 · CPE version 11.2.13 · CPE version 11.2.13 · CPE version 11.2.13 · CPE version 11.2.13 · CPE version 11.2.15 · CPE version 11.2.16 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.5 · CPE version 12.1.6 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.8 · CPE version 12.1.9 · CPE version 12.1.10 · CPE version 12.1.10 · CPE version 12.2.4 |
| paloaltonetworks | panorama_virtual_appliance | Version not specified in CPE |
| siemens | blueplanet_360_nx3_m6_wm_od_iisx_firmware | Version not specified in CPE |
| siemens | blueplanet_360_nx3_m6_wm_od_iisx-s_firmware | Version not specified in CPE |
| siemens | energy_engage | CPE version 2.0 · CPE version 3.1 |
| siemens | spectrum_power_4 | Version not specified in CPE |
| siemens | spectrum_power_7 | Version not specified in CPE |
| siemens | spectrum_power_tg | Version not specified in CPE |
| siemens | amis_ts | Version not specified in CPE |
Remediation & validation
- Prioritize immediately: CISA lists this CVE in its Known Exploited Vulnerabilities catalog. Confirm exposure, apply the vendor fix and validate mitigation.
- Identify exposure by comparing the affected product and version ranges with your asset inventory, SBOM and externally exposed services.
- Review the linked vendor security advisory or patch notes. Upgrade to a vendor-confirmed fixed release; do not infer a fixed version from the CVE description.
- Until patched, consider restricting network access or disabling the affected feature where operationally safe. These are temporary controls, not a substitute for a vendor fix.
- Validate the remediation with a version check and vulnerability rescan, then retain change evidence.
No fixed version is displayed unless it is explicitly established by a vendor advisory. Follow the vendor's release notes for exact product and branch applicability.
Vendor advisories, patches & exploit references
- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w ADVISORY security@php.net
- http://seclists.org/fulldisclosure/2026/Oct/51 REFERENCE af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2026/10/21/6 ADVISORY af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2026/10/23/5 ADVISORY af854a3a-2127-422b-91ae-364da2661108
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/ ADVISORY 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://cert-portal.siemens.com/productcert/html/ssa-166980.html ADVISORY 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
- https://cert-portal.siemens.com/productcert/html/ssa-566435.html ADVISORY 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
- https://cert-portal.siemens.com/productcert/html/ssa-566512.html ADVISORY 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
- https://php2shell.delftintellab.com ADVISORY 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618 EXPLOIT 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://www.wiz.io/blog/php2shell-php-rce ADVISORY 134c704f-9b21-4f2e-91b3-4a467353bcc0