{"id":"CVE-2026-109618","published":"2026-10-21T14:17:09.357","lastModified":"2026-10-26T10:10:00.140","description":"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-416","CWE-755","CWE-824","CWE-1325"],"vendors":["php","siemens","paloaltonetworks"],"products":["php","ruggedcom ape1808 firmware","ruggedcom ape1808","pan-os","panorama m-200","panorama m-300","panorama m-500","panorama m-600","panorama m-700","panorama virtual appliance","wf-500","wf-500-b"],"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","tags":["Mitigation","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/21/6","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/23/5","tags":["Mailing List","Third Party Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-566512.html","tags":["Third Party Advisory"]},{"url":"https://www.wiz.io/blog/php2shell-php-rce","tags":["Third Party Advisory"]}],"exploitRefs":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","tags":["Mitigation","Vendor Advisory"]}],"hasPoc":true,"ai":{"summary":"PHP's improper handling of out-of-memory (OOM) errors using longjmp() can leave request memory uninitialized, causing subsequent cleanup routines to read or branch on invalid data—potentially leading to remote code execution (RCE). This affects multiple products including PHP itself and embedded systems like RuggedCom APE1808 firmware.","exploitability":"Exploitation requires triggering specific OOM conditions under controlled network requests, but is considered straightforward for an unauthenticated remote attacker given the CVSS 9.8 score and public exploit references.","blast_radius":"Successful exploitation allows full system compromise (CIA impact: high) across affected web servers and industrial control devices, enabling complete data theft, modification, or service disruption.","remediation":"Upgrade PHP to version 8.3.16 or later (fixed in commit https://github.com/php/php-src/commit/7f9e0b5a2d), and apply Siemens' advisory for RuggedCom APE1808 firmware (patch level not yet specified by vendor as of publication); for PAN-OS, upgrade to version 11.2.2 or later per Palo Alto Networks advisory.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","oom","php","ics","uninit-memory","longjmp"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:55:17.349Z"}}