Quantum Secular Labs / Blog / Advisories

CVE-2026-109618: PHP Memory Corruption Vulnerability

CVE-2026-109618 is rated critical with a CVSS v3.1 base score of 9.8 and affects PHP Group PHP, along with 10 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-26, which means exploitation in the wild has been observed.

Vulnerability description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Severity breakdown

CVSS v3.1 9.8: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Unchanged. Impact stays within the vulnerable component.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-416: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

CWE-755: Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

CWE-824: Access of Uninitialized Pointer

The product accesses or uses a pointer that has not been initialized.

Affected products

  • PHP: from 7.3.0 before 8.2.35; from 8.3.0 before 8.3.36; from 8.4.0 before 8.4.27; from 8.5.0 before 8.5.12
  • Siemens Ruggedcom Ape1808 Firmware: all versions listed by NVD
  • Paloaltonetworks Pan OS: from 10.2.0 before 10.2.7; 10.2.7; 10.2.7 h1; 10.2.7 h10; 10.2.7 h11; 10.2.7 h12; 10.2.7 h13; 10.2.7 h14; 10.2.7 h15; 10.2.7 h16; 10.2.7 h17; 10.2.7 h18
  • Paloaltonetworks Panorama Virtual Appliance: all versions listed by NVD
  • Siemens Blueplanet 360 Nx3 M6 Wm Od Iisx Firmware: all versions listed by NVD
  • Siemens Blueplanet 360 Nx3 M6 Wm Od Iisx S Firmware: all versions listed by NVD
  • Siemens Energy Engage: 2.0 service_pack9; 3.1 service_pack1
  • Siemens Spectrum Power 4: all versions listed by NVD
  • Siemens Spectrum Power 7: all versions listed by NVD
  • Siemens Spectrum Power Tg: all versions listed by NVD
  • Siemens Amis Ts: all versions listed by NVD

References