Skip to content
Fencer Vulns
critical 9.8

CVE-2026-109618 kev in the critical feed json

RCE via OOM corruption

published 2026-10-21 18 d ago modified 2026-11-05 3 d ago also BIT-libphp-2026-109618 , BIT-php-2026-109618 , BIT-php-min-2026-109618 , EUVD-2026-107260 , GHSA-w8hw-w9fx-j79w

cvss
9.8
version 3.1, NVD
cisa kev
Exploited
added 2026-10-26
epss
100.0%
EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
public exploits
1
Exploit-DB, plus a Nuclei check

Summary

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Patch / fix

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

  • bitnami libphp 8.2.35, 8.3.36, 8.4.27, 8.5.12
  • bitnami php 8.2.35, 8.3.36, 8.4.27, 8.5.12
  • bitnami php-min 8.2.35, 8.3.36, 8.4.27, 8.5.12
  • PHP Group PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12
  • Siemens Local Monitoring bt-monitoring-vm V20261103
  • php8.2 Debian 12 8.2.35-1~deb12u1
  • php8.4 Debian 13 8.4.27-1~deb13u1
  • php8.4 Debian 14 8.4.27-1

debian advisories DEBIAN-CVE-2026-109618

  • php8.1 Ubuntu 22.04 LTS 8.1.2-1ubuntu2.28
  • php8.3 Ubuntu 24.04 LTS 8.3.6-0ubuntu0.24.04.13
  • php8.5 Ubuntu 26.10 8.5.9-0ubuntu2.1
  • php8.5 Ubuntu 26.04 LTS 8.5.4-0ubuntu1.5
  • php5 Ubuntu Pro 14.04 LTS 5.5.9+dfsg-1ubuntu4.29+esm18
  • php7.0 Ubuntu Pro 16.04 LTS 7.0.33-0ubuntu0.16.04.16+esm22
  • php7.2 Ubuntu Pro 18.04 LTS 7.2.24-0ubuntu0.18.04.17+esm14
  • php7.4 Ubuntu Pro 20.04 LTS 7.4.3-4ubuntu2.29+esm5

ubuntu advisories UBUNTU-CVE-2026-109618

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • php74 SLE Module for Web and Scripting 12 7.4.33-1.74.1
  • php7 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +7 more 7.4.33-150400.4.81.1
  • php7-fpm SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +6 more 7.4.33-150400.4.81.1
  • php7-test SLE Module for Package Hub 15 SP7 7.4.33-150400.4.81.2
  • php7-embed SLE Module for Package Hub 15 SP7 7.4.33-150400.4.81.1
  • php7-fastcgi SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +6 more 7.4.33-150400.4.81.1
  • apache2-mod_php7 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +7 more 7.4.33-150400.4.81.1
  • php8 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 8.0.30-150400.4.80.1

suse advisories SUSE-SU-2026:4870-1SUSE-SU-2026:4853-1SUSE-SU-2026:4852-1SUSE-SU-2026:24271-1SUSE-SU-2026:4844-1SUSE-SU-2026:4843-1

  • matomo openSUSE Tumbleweed 5.14.2-1.1
  • php8 openSUSE Leap 16.0 8.4.27-160000.1.1
  • php8-fpm openSUSE Leap 16.0 8.4.27-160000.1.1
  • php8-test openSUSE Leap 16.0 8.4.27-160000.1.1
  • php8-embed openSUSE Leap 16.0 8.4.27-160000.1.1
  • php8-fastcgi openSUSE Leap 16.0 8.4.27-160000.1.1
  • apache2-mod_php8 openSUSE Leap 16.0 8.4.27-160000.1.1
  • php8 openSUSE Tumbleweed 8.5.12-1.1

opensuse advisories openSUSE-SU-2026:12228-1openSUSE-SU-2026:22151-1openSUSE-SU-2026:12219-1

  • php AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-gd AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-cli AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-dba AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-dbg AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-fpm AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-gmp AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-pdo AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1

almalinux advisories ALSA-2026:A011ALSA-2026:A012ALSA-2026:A013ALSA-2026:A014ALSA-2026:87070ALSA-2026:87071

  • php Rocky Linux 8 8.2.35-1.module+el8.10.0+40394+d21b33fb
  • libzip Rocky Linux 8 1.7.3-1.module+el8.10.0+1605+02e07af7
  • libzip Rocky Linux 8 1.7.3-1.module+el8.10.0+1596+477f03f8
  • libzip Rocky Linux 8 1.7.3-1.module+el8.10.0+1911+f499711e
  • php-pear Rocky Linux 8 1:1.10.14-1.module+el8.10.0+1911+f499711e
  • php-pear Rocky Linux 8 1:1.10.14-1.module+el8.10.0+1596+477f03f8
  • php-pecl-rrd Rocky Linux 8 2.0.3-1.module+el8.10.0+1911+f499711e
  • php-pecl-rrd Rocky Linux 8 2.0.3-1.module+el8.10.0+1596+477f03f8

rocky linux advisories RLSA-2026:87073RLSA-2026:87070RLSA-2026:87071RLSA-2026:87072RLSA-2026:87079RLSA-2026:87151

  • php82 Alpine 3.22, Alpine 3.21 8.2.35-r0
  • php83 Alpine 3.24, Alpine 3.23, Alpine 3.22 8.3.36-r0
  • php84 Alpine 3.24, Alpine 3.23, Alpine 3.22 8.4.27-r0
  • php85 Alpine 3.24, Alpine 3.23 8.5.12-r0

alpine advisories ALPINE-CVE-2026-109618

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • php Azure Linux 3.0 8.3.35-2
  • php-cli Azure Linux 3.0 8.3.35-2

azure linux advisories AZL-109815AZL-112315

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • php Arch Linux 8.5.12-1
  • php-legacy Arch Linux 8.3.36-1

arch linux advisories AVG-2909AVG-2910

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-109618 updated cvss 8.1

php: OOM bailout during request parsing leads to memory corruption and RCE

  • Red Hat Enterprise Linux 6 php, php-gd, php-cli, php-dba, php-fpm, php-pdo, +20 more
    affected: workaround, no fix planned “See the security bulletin for a detailed mitigation procedure.”
  • Red Hat Enterprise Linux 9 php, php-gd, php-cli, php-dba, php-dbg, php-ffi, +18 more
    affected: workaround, no fix available “See the security bulletin for a detailed mitigation procedure.”
  • Red Hat Enterprise Linux AppStream (v. 8) php 7.4.33-8.module+el8.10.0+25117+30337cca, php 8.2.35-1.module+el8.10.0+25110+f67151d2, libzip 1.6.1-1.module+el8.10.0+22485+a3539972, libzip 1.7.3-1.module+el8.10.0+20770+a5eca186, php-gd 7.4.33-8.module+el8.10.0+25117+30337cca, php-gd 8.2.35-1.module+el8.10.0+25110+f67151d2, +60 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:87080
  • Red Hat Enterprise Linux AppStream (v. 9) php 8.0.30-8.el9_8.1, php-gd 8.0.30-8.el9_8.1, php-cli 8.0.30-8.el9_8.1, php-dba 8.0.30-8.el9_8.1, php-dbg 8.0.30-8.el9_8.1, php-ffi 8.0.30-8.el9_8.1, +77 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:87072
  • Red Hat Enterprise Linux AppStream (v. 10) php 8.3.36-1.el10_2, php-gd 8.3.36-1.el10_2, php8.4 8.4.27-1.el10_2, php-cli 8.3.36-1.el10_2, php-dba 8.3.36-1.el10_2, php-dbg 8.3.36-1.el10_2, +42 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:87070
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-gd 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-cli 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-dba 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-dbg 7.4.6-5.module+el8.4.0+25156+e0c98721.3, +28 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88565
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, php-gd 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, apcu-panel 5.1.18-1.module+el8.3.0+6678+b09f589e, php-cli 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, php-dba 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, +28 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88533
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, php-gd 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, apcu-panel 5.1.18-1.module+el8.3.0+6678+b09f589e, php-cli 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, php-dba 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, +28 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88532
show 10 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) php 8.0.30-1.el9_2.2, php-gd 8.0.30-1.el9_2.2, php-cli 8.0.30-1.el9_2.2, php-dba 8.0.30-1.el9_2.2, php-dbg 8.0.30-1.el9_2.2, php-ffi 8.0.30-1.el9_2.2, +18 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88659
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) php 8.0.30-1.el9_4.2, php-gd 8.0.30-1.el9_4.2, php-cli 8.0.30-1.el9_4.2, php-dba 8.0.30-1.el9_4.2, php-dbg 8.0.30-1.el9_4.2, php-ffi 8.0.30-1.el9_4.2, +47 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88835
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) php 8.3.19-1.el10_0.2, php-gd 8.3.19-1.el10_0.2, php-cli 8.3.19-1.el10_0.2, php-dba 8.3.19-1.el10_0.2, php-dbg 8.3.19-1.el10_0.2, php-ffi 8.3.19-1.el10_0.2, +18 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88561
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) php 8.0.30-3.el9_6.2, php-gd 8.0.30-3.el9_6.2, php-cli 8.0.30-3.el9_6.2, php-dba 8.0.30-3.el9_6.2, php-dbg 8.0.30-3.el9_6.2, php-ffi 8.0.30-3.el9_6.2, +77 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88834
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-gd 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-cli 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-dba 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-dbg 7.4.6-5.module+el8.4.0+25156+e0c98721.3, +28 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88565
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, php-gd 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, apcu-panel 5.1.18-1.module+el8.3.0+6678+b09f589e, php-cli 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, php-dba 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, +28 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88533
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, php-gd 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, apcu-panel 5.1.18-1.module+el8.3.0+6678+b09f589e, php-cli 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, php-dba 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, +28 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88532
  • Red Hat Hardened Images php 8.5.12-1.hum1, php-gd 8.5.12-1.hum1, php-cli 8.5.12-1.hum1, php-dba 8.5.12-1.hum1, php-dbg 8.5.12-1.hum1, php-ffi 8.5.12-1.hum1, +21 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:87414
  • Red Hat OpenShift Dev Spaces 3.31 devspaces/udi-rhel9 1792708612
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:90321
  • Red Hat Enterprise Linux 7 php, php-gd, php-cli, php-dba, php-fpm, php-pdo, +18 more Red Hat OpenShift AI (RHOAI) rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Dev Spaces devspaces/code-rhel9 Red Hat OpenShift Dev Spaces 3.31 devspaces/code-rhel9 1792599388, devspaces/server-rhel9 1792775639, devspaces/openvsx-rhel9 1792494821, devspaces/traefik-rhel9 1792464177, devspaces/udi-base-rhel9 1792686842, devspaces/code-sshd-rhel9 1792598059, +9 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa vex VA-26-295-01 updated cvss 8.1

PHP insecure error handling and state management

  • php-src <8.2.35, <8.3.36, <8.4.27, <8.5.12
    affected: vendor fix github.com
  • php-src 8.2.35, 8.3.36, 8.4.27, 8.5.12
    fixed: vendor fix github.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. CISA SSVC: exploitation active
  2. Published
  3. First public exploit (EDB-52704)
  4. Added to CISA KEV
  5. CISA patch deadline

Known exploited

Added
14 d ago
Patch by
2026-10-29 (11 d ago)
Ransomware
Not known
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Vendor, product
PHP Group, PHP
CISA name
PHP Memory Corruption Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
19 d ago

Exploit prediction

100.00% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-52704 PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE remote, 2026-10-22
  • Nuclei template PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection nuclei detection template

CVSS scores

assigned by version score vector
CNA 4.0 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami libphp
>=7.3.0, <8.2.35
>=8.3.0, <8.3.36
>=8.4.0, <8.4.27
>=8.5.0, <8.5.12
8.2.35
8.3.36
8.4.27
8.5.12
bitnami php
>=7.3.0, <8.2.35
>=8.3.0, <8.3.36
>=8.4.0, <8.4.27
>=8.5.0, <8.5.12
8.2.35
8.3.36
8.4.27
8.5.12
bitnami php-min
>=7.3.0, <8.2.35
>=8.3.0, <8.3.36
>=8.4.0, <8.4.27
>=8.5.0, <8.5.12
8.2.35
8.3.36
8.4.27
8.5.12

Affected products

  • PHP Group PHP
  • Siemens AMIS TS
  • Siemens AX4
  • Siemens blueplanet 360 NX3 M6 WM OD IISX
  • Siemens blueplanet 360 NX3 M6 WM OD IISX - S
  • Siemens Building X
  • Siemens CADRA
  • Siemens Call stations
  • Siemens Capital
  • Siemens Chargesight
  • Siemens Climatix Cloud IC
  • Siemens Climatix Devices
  • Siemens Connect Insights
  • Siemens Connect X200
  • Siemens Connect X300
  • Siemens Connect X500
  • Siemens cRSP
  • Siemens Depotfinity
  • Siemens Designcenter
  • Siemens Designcenter X
  • Siemens Designcenter X Essentials
  • Siemens Desigo CC
  • Siemens Desigo DXR2
  • Siemens Desigo DXR3
  • Siemens Desigo Optic
  • Siemens Desigo PXC3
  • Siemens Desigo PXC4
  • Siemens Desigo PXC5
  • Siemens Desigo PXC7
  • Siemens DFMExpress
  • Siemens Energy Engage V2.0SP9
  • Siemens Energy Engage V3.1SP1
  • Siemens Energy Management System
  • Siemens Enlighted RTLS
  • Siemens Enlighted Space
  • Siemens Heliox Flex Pro
  • Siemens Heliox H60
  • Siemens Heliox Rapid
  • Siemens HyperLynx
  • Siemens Insights Hub
  • Siemens Local Monitoring bt-monitoring-vm
  • Siemens Navigator E&S
  • Siemens Novigo VANSYS
  • Siemens Novigo VANSYS core
  • Siemens Opcenter Connect Electronics
  • Siemens Opcenter Connect MOM
  • Siemens Opcenter Execution Core
  • Siemens Opcenter Execution Discrete
  • Siemens Opcenter Execution Foundation
  • Siemens Opcenter Execution Pharma

Classification

Weakness
  • CWE-416 Use After Free
  • CWE-755 Improper Handling of Exceptional Conditions
  • CWE-824 Access of Uninitialized Pointer
  • CWE-1325 Improperly Controlled Sequential Memory Allocation
  • CWE-1419 Incorrect Initialization of Resource
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of php/php-src published their own advisory on GitHub. Reviewed sources take precedence over it.