Search/CVE-2026-109618
● CVE — Critical

CVE-2026-109618

Vendorpaloaltonetworks, php, siemensProductpan-os, php, ruggedcom ape1808 firmware, panorama virtual applianceDiscoveredOct 21, 2026UpdatedOct 23, 2026

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVSS v3.1
9.8 CRITICAL
EPSS
99.9%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
38
sources referencing this CVE
Related IOCs
seen in the same coverage
EPSS Trend
Oct 23, 2026 → Oct 26, 2026
▲ 94.7pp
5.31% → 99.9% over 4 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
47 relationships
Timeline
disclosure → media coverage
Oct 21, 2026
Disclosure — published as a CVE record.
Oct 21, 2026
isc.sans.edu reports: Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
Oct 21, 2026
aws.amazon.com reports: PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Oct 21, 2026
aws.amazon.com reports: Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
Oct 21, 2026
theregister.com reports: PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
Oct 22, 2026
aws.amazon.com reports: Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Oct 22, 2026
redhotcyber.com reports: PHP2Shell è allarme PHP! Due falle critiche aprono la strada agli hacker nei server web di tutto il mondo
Oct 22, 2026
thehackernews.com reports: Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Oct 22, 2026
itmedia.co.jp reports: PHP脆弱性“PoCフライング公開”の経緯、支援財団が公表 混乱広げた企業を名指しで批判
Oct 22, 2026
infosecurity-magazine.com reports: PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
Oct 22, 2026
helpnetsecurity.com reports: What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Oct 22, 2026
helpnetsecurity.com reports: New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619
Oct 22, 2026
theregister.com reports: Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
Oct 22, 2026
securityweek.com reports: Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Oct 22, 2026
bleepingcomputer.com reports: Amazon says PHP2Shell exploitation began 4 days before patches
Oct 22, 2026
schneier.com reports: New Serious PHP Vulnerabilities Released and Patched
Oct 22, 2026
cybersecitalia.it reports: PHP, OpenAI scopre una falla che mette al rischio fino al 70% dei siti a livello globale
Oct 22, 2026
theregister.com reports: PHP2Shell puts dozens of UK government services out of service
Oct 22, 2026
theregister.com reports: PHP2Shell exploit bypasses protections designed to stop remote code execution
Oct 22, 2026
kaspersky.com reports: How new PHP vulnerabilities threaten home users | Kaspersky official blog
Oct 22, 2026
atmarkit.itmedia.co.jp reports: PHP脆弱性問題は“また起こる” 事件の裏にあったエンジニアの根深い課題
Oct 22, 2026
atmarkit.itmedia.co.jp reports: EOLのPHP 7.4、8.0、8.1にも異例のパッチ JPCERT/CCが警告する「php2shell」の侵害痕跡3つと緊急対策
Oct 23, 2026
therecord.media reports: Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
Oct 23, 2026
crowdstrike.com reports: Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation
Oct 23, 2026
thehackernews.com reports: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Oct 23, 2026
cybersecitalia.it reports: PHP2Shell, CERT-AGID segnala due strumenti per verificare i sistemi vulnerabili
Oct 23, 2026
cybersecurity360.it reports: PHP2Shell, perché applicare le patch non basta a mettere in sicurezza i sistemi
Oct 23, 2026
thehackernews.com reports: PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
Oct 23, 2026
securityweek.com reports: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Oct 23, 2026
bleepingcomputer.com reports: PHP shares mitigation for new RCE vulnerability with no patch
Oct 23, 2026
unit42.paloaltonetworks.com reports: Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)
Oct 23, 2026
theregister.com reports: There's a third PHP2Shell bug, but it won't get an emergency fix
Oct 24, 2026
redhotcyber.com reports: Da PHP a Linux: gravi vulnerabilità nel kernel OS diffuse prima del rilascio delle patch
Oct 25, 2026
helpnetsecurity.com reports: Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw
Oct 25, 2026
redhotcyber.com reports: Amazon: PHP2Shell sfruttato quattro giorni prima delle patch
Oct 25, 2026
acn.gov.it reports: PHP2Shell: aggiornare immediatamente i sistemi vulnerabili
Oct 25, 2026
thehackernews.com reports: PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
Oct 25, 2026
cybersecitalia.it reports: L’alert dell’ACN: “In Italia a rischio vulnerabilità oltre 250mila servizi PHP, fare subito l’aggiornamento”. PHP è uno dei linguaggi per far funzionare gran parte del Web
Oct 26, 2026
cybersecurity360.it reports: Come l’AI sta cambiando gli attacchi cyber e come difendersi