CVE-2026-109618 KEV EXPLOIT
9.8
CRITICAL · CVSS 3.1 · EPSS 100% (pctl 100)
Patch first
On CISA KEV — known exploited in the wild, due 2026-10-29.
Description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 99.98% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-416 |
| On CISA KEV | yes — remediate by 2026-10-29 |
| Public exploit | yes |
| Published | 2026-10-21 |
| Last modified | 2026-10-26 |
CISA KEV
| Name | PHP Memory Corruption Vulnerability |
|---|---|
| Added | 2026-10-26 |
| Due | 2026-10-29 |
| Vendor / product | PHP Group / PHP |
| Ransomware use | none reported |
Affected (12)
| Vendor | Product |
|---|---|
| paloaltonetworks | pan-os |
| paloaltonetworks | panorama m-200 |
| paloaltonetworks | panorama m-300 |
| paloaltonetworks | panorama m-500 |
| paloaltonetworks | panorama m-600 |
| paloaltonetworks | panorama m-700 |
| paloaltonetworks | panorama virtual appliance |
| paloaltonetworks | wf-500 |
| paloaltonetworks | wf-500-b |
| php | php |
| siemens | ruggedcom ape1808 |
| siemens | ruggedcom ape1808 firmware |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE | 2026-10-22 |
References
→ the Explorer · watch your stack · NVD