Vulnerability details
CVE-2026-109618
Actively exploited
PHP Group PHPSiemens AMIS TSSiemens Energy EngageSiemens Local Monitoring bt-monitoring-vmSiemens RUGGEDCOM APE1808Siemens Spectrum Power 4
RCE via OOM corruption
CVSS 4.0
9.2Critical
Official description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Related news
-
Week in review: Refrigeration cyberattacks hit European retailers again, Patch Tuesday forecast
Help Net Security · 1 d ago
-
November 2026 Patch Tuesday forecast: Old software continues to bite
Help Net Security · 4 d ago
-
Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
The Register · 11 d ago
-
CISA confirms PHP2Shell under attack as researchers clock successful exploits
The Register · 13 d ago
-
PHP2Shell: What to know about two critical PHP flaws
WeLiveSecurity · 14 d ago
-
New Serious PHP Vulnerabilities Released and Patched
Schneier on Security · 18 d ago
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.2Critical | 4.0 | CVEProject cvelistV5 (CNA) (php) | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| PHP Group | PHP | 8.2.* ≤ v < 8.2.35 | CVEProject cvelistV5 (CNA) |
| PHP Group | PHP | 8.3.* ≤ v < 8.3.36 | CVEProject cvelistV5 (CNA) |
| PHP Group | PHP | 8.4.* ≤ v < 8.4.27 | CVEProject cvelistV5 (CNA) |
| PHP Group | PHP | 8.5.* ≤ v < 8.5.12 | CVEProject cvelistV5 (CNA) |
| Siemens | AMIS TS | All | CVEProject cvelistV5 (CNA) |
| Siemens | Energy Engage V2.0SP9 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Energy Engage V3.1SP1 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Local Monitoring bt-monitoring-vm | v < V20261103 | CVEProject cvelistV5 (CNA) |
| Siemens | RUGGEDCOM APE1808 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Spectrum Power 4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Spectrum Power 4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Spectrum Power 4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Spectrum Power 7 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Spectrum Power TG | All | CVEProject cvelistV5 (CNA) |
| Siemens | blueplanet 360 NX3 M6 WM OD IISX | All | CVEProject cvelistV5 (CNA) |
| Siemens | blueplanet 360 NX3 M6 WM OD IISX - S | All | CVEProject cvelistV5 (CNA) |
References and advisories
11- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w vendor-advisory
- https://www.wiz.io/blog/php2shell-php-rce third-party-advisory
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/ third-party-advisory
- https://php2shell.delftintellab.com third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618 government-resource
- http://www.openwall.com/lists/oss-security/2026/10/21/6
- http://www.openwall.com/lists/oss-security/2026/10/23/5
- http://seclists.org/fulldisclosure/2026/Oct/51
- https://cert-portal.siemens.com/productcert/html/ssa-566512.html
- https://cert-portal.siemens.com/productcert/html/ssa-566435.html
- https://cert-portal.siemens.com/productcert/html/ssa-166980.html
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-21
- Last updated
- 2026-11-05
- State
- Published
- Assigner (CNA)
- php
- Kolun priority
- 79 · High
CISA KEV catalog
- Date added
- 2026-10-26
- Due date
- 2026-10-29
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
99.99%
Probability of exploitation in 30 days
99.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-416Use after free
- CWE-755Improper Handling of Exceptional Conditions
- CWE-824Access of uninitialized pointer
- CWE-1325Improperly controlled sequential memory allocation
- CWE-1419Incorrect Initialization of Resource