Vulnerability Description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | >= 7.3.0, < 8.2.35 |
| Siemens | Ruggedcom Ape1808 Firmware | - |
| Siemens | Ruggedcom Ape1808 | - |
| Paloaltonetworks | Pan-Os | >= 10.2.0, < 10.2.7 |
| Paloaltonetworks | Panorama M-200 | - |
| Paloaltonetworks | Panorama M-300 | - |
| Paloaltonetworks | Panorama M-500 | - |
| Paloaltonetworks | Panorama M-600 | - |
| Paloaltonetworks | Panorama M-700 | - |
| Paloaltonetworks | Panorama Virtual Appliance | - |
| Paloaltonetworks | Wf-500 | - |
| Paloaltonetworks | Wf-500-B | - |
Related Weaknesses (CWE)
References
- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79wMitigationVendor Advisory
- http://seclists.org/fulldisclosure/2026/Oct/51Mailing List
- http://www.openwall.com/lists/oss-security/2026/10/21/6Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/23/5Mailing ListThird Party Advisory
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enaThird Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-166980.html
- https://cert-portal.siemens.com/productcert/html/ssa-566435.html
- https://cert-portal.siemens.com/productcert/html/ssa-566512.htmlThird Party Advisory
- https://php2shell.delftintellab.comThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-US Government Resource
- https://www.wiz.io/blog/php2shell-php-rceThird Party Advisory
FAQ
What is CVE-2026-109618?
CVE-2026-109618 is a vulnerability with a CVSS score of 9.8 (CRITICAL). PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an...
How severe is CVE-2026-109618?
CVE-2026-109618 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-109618?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php, Siemens Ruggedcom Ape1808 Firmware, Siemens Ruggedcom Ape1808, Paloaltonetworks Pan-Os, Paloaltonetworks Panorama M-200.