CVE-2026-109618
Description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
How to fix
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: Oct 29, 2026- php php8.2.35, 8.3.36, 8.4.27, 8.5.12 or later
- paloaltonetworks pan-os10.2.7, 11.1.4, 11.2.4, 12.1.4, 12.2.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| php php | 7.3.0 ≤ v < 8.2.35, 8.3.0 ≤ v < 8.3.36, 8.4.0 ≤ v < 8.4.27, 8.5.0 ≤ v < 8.5.12 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
| siemens ruggedcom_ape1808_firmware | No range specified | — |
| paloaltonetworks pan-os | 10.2.0 ≤ v < 10.2.7, 10.2.7, 10.2.8, 10.2.9, 10.2.10, 10.2.11, 10.2.12, 10.2.13, 10.2.14, 10.2.15, 10.2.16, 10.2.17, 10.2.18, 11.1.0 ≤ v < 11.1.4, 11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.1.8, 11.1.9, 11.1.10, 11.1.11, 11.1.12, 11.1.13, 11.1.14, 11.1.15, 11.1.16, 11.2.0 ≤ v < 11.2.4, 11.2.4, 11.2.5, 11.2.6, 11.2.7, 11.2.8, 11.2.9, 11.2.10, 11.2.11, 11.2.12, 11.2.13, 11.2.15, 11.2.16, 12.1.0 ≤ v < 12.1.4, 12.1.4, 12.1.5, 12.1.6, 12.1.7, 12.1.8, 12.1.9, 12.1.10, 12.2.0 ≤ v < 12.2.4, 12.2.4, No range specified | 10.2.7, 11.1.4, 11.2.4, 12.1.4, 12.2.4 |
| paloaltonetworks panorama_virtual_appliance | No range specified | — |
| siemens blueplanet_360_nx3_m6_wm_od_iisx_firmware | No range specified | — |
| siemens blueplanet_360_nx3_m6_wm_od_iisx-s_firmware | No range specified | — |
| siemens energy_engage | 2.0, 3.1 | — |
| siemens spectrum_power_4 | No range specified | — |
| siemens spectrum_power_7 | No range specified | — |
| siemens spectrum_power_tg | No range specified | — |
| siemens amis_ts | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.