VulnSocial
← Back to blog

CVE-2026-109618 – Critical PHP Memory Corruption Enables Unauthenticated Remote Code Execution

TL;DR: A Critical memory corruption flaw in PHP's out-of-memory handling allows unauthenticated remote code execution. CVSS 9.8, CISA KEV listed, actively exploited since disclosure — patch immediately.

Overview

CVE-2026-109618 is a Critical remote code execution vulnerability affecting PHP versions 8.1 through 8.x. The root cause: PHP uses longjmp() for out-of-memory (OOM) error handling to exit the current context and abort request processing. Some contexts leave request memory in an uninitialized state before performing subsequent allocations, and later cleanup routines read or branch on that garbage memory. Multiple OOM strategies consistently trigger this condition, making exploitation reliable.

This vulnerability is part of the broader PHP2Shell family alongside CVE-2026-109619. Kaspersky and other vendors have detected exploitation activity tied to these advisories.

Technical Details

When PHP exhausts memory, longjmp() unwinds the stack to abort request handling. In affected builds, certain contexts do not properly initialize memory before performing allocations after such aborts. This leaves request memory in an uninitialized state that subsequent cleanup procedures may read or branch on. An attacker who reliably triggers one of these OOM paths can leverage stale memory contents to execute arbitrary code.

The vulnerability has been attributed to multiple CWEs including CWE-416 (use-after-free), CWE-755 (incorrect exception handling), CWE-824 (out-of-bounds read), and CWE-1325 (incorrect resource handling).

Severity & Impact

The CVSS v3.1 score is 9.8 Critical, with Network attack vector, Low attack complexity, and High confidentiality, integrity, and availability impacts. The vulnerability is now listed in the CISA Known Exploited Vulnerabilities catalog (CISA KEV), adding urgency to remediation.

Active exploitation has been observed since disclosure. On the third day post-disclosure, 134 active exploitation reports were recorded, signaling real-world weaponization. For the full signal timeline and live threat intelligence, see the CVE page.

Affected Products

The primary affected product is PHP itself (versions 8.1–8.x). Beyond the core interpreter, the CPE data also covers several network and industrial products running embedded PHP or dependent on affected builds:

  • Palo Alto Networks Pan-OS (versions 10.2.10–10.2.18, 11.1.x, 11.2.x, 12.1.x, 12.2.4)
  • Siemens spectrum_power_4/7/tg, energy_engage, ruggedcom_ape1808 and related firmware
  • Blue Planet 360 NX3 M6 appliances

For the complete list of affected products and versions, see the CVE page.

Actionable Insights

  • Patch immediately. With CVSS 9.8 and active exploitation since disclosure, this is a top-priority remediation. Upgrade all PHP installations to the latest stable release recommended by the PHP security team.
  • Inventory every PHP deployment. Embedded PHP in firewalls, industrial controllers, and appliances is equally vulnerable — don't assume only web servers are at risk.
  • Monitor for exploitation patterns. Active exploitation peaked at 134 reports on 2026-10-22. Check PHP process logs for anomalous behavior, unexpected file writes, or outbound connections from worker processes.
  • Apply vendor-specific patches. For Pan-OS, Siemens spectrum, and ruggedcom products, consult the respective vendor advisories.
  • Follow CISA BOD 26-04 guidance. Prioritize updates based on risk, ensure compliance with forensics triage requirements, and discontinue affected products if mitigations are unavailable.

Remediation & Mitigation

  1. Upgrade PHP. Replace all affected PHP installations with the latest stable release (8.3.x or later) per the vendor advisory GHSA-w8hw-w9fx-j79w.
  2. Isolate PHP workloads. Place PHP frontends behind WAFs and restrict egress from PHP worker processes to limit blast radius.
  3. Disable OOM paths where possible. Configure PHP to handle OOM errors without leaving memory uninitialized, though this requires upstream changes unavailable in older releases.
  4. Apply vendor patches. Consult Siemens advisories SSA-166980, SSA-566435, SSA-566512; the arcticwolf advisory; and the Wiz advisory for embedded product fixes.
  5. Comply with CISA guidance. Apply BOD 26-04 prioritization and ensure adherence to forensics triage requirements.

References

Bottom line

CVE-2026-109618 is a Critical RCE in PHP with CVSS 9.8, CISA KEV listing, and active exploitation since disclosure. Patch all PHP instances immediately and apply vendor-specific fixes for embedded products. For live threat activity tracking, see the CVE page.

#CVE #Critical #RCE #CISAKEV #CVE2026109618 #PHP #MemoryCorruption