IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
9.2Critical KEV

CVE-2026-109618RCE via OOM corruption

PHP Group PHP; Siemens AX4; Siemens CADRA; Siemens Capital Published: (11 days ago)

Known exploited — PHP Memory Corruption Vulnerability

CISA confirmed this vulnerability is used in real attacks on 26.10.2026. Remediation deadline for US federal agencies: 29.10.2026.

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109618

Description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Weakness (CWE): CWE-416CWE-755CWE-824CWE-1325CWE-1419

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
paloaltonetworks pan-os 10.2.0 – < 10.2.7
paloaltonetworks panorama virtual appliance —
PHP Group PHP 8.2.* – < 8.2.35, 8.3.* – < 8.3.36, 8.4.* – < 8.4.27, 8.5.* – < 8.5.12
Siemens AMIS TS 0
Siemens AX4 —
Siemens blueplanet 360 NX3 M6 WM OD IISX 0
Siemens blueplanet 360 NX3 M6 WM OD IISX - S 0
Siemens CADRA —
Siemens Capital —
Siemens Designcenter —
Siemens Designcenter X —
Siemens DFMExpress —
Siemens Energy Engage V2.0SP9 0
Siemens Energy Engage V3.1SP1 0
Siemens HyperLynx —
Siemens Insights Hub —
Siemens Opcenter Connect Electronics —
Siemens Opcenter Connect MOM —
Siemens Opcenter Execution Core —
Siemens Opcenter Execution Foundation —
Siemens Opcenter Execution Pharma —
Siemens Opcenter Intelligence —
Siemens Opcenter Intra Plant Logistics —
Siemens Opcenter Quality —
Siemens Opcenter RDnL —
Siemens Opcenter X —
Siemens PADS Pro Essentials —
Siemens PADS Pro Student Edition —
Siemens PADS Professional —
Siemens PADS Professional - XCR —
Siemens PADS Standard & Standard Plus —
Siemens PADS Standard - XCR —
Siemens Polarion —
Siemens QuadView —
Siemens RUGGEDCOM APE1808 0
siemens ruggedcom ape1808 firmware —
Siemens Simcenter Flomaster —
Siemens Simcenter Flux —
Siemens Simcenter Simlab —
Siemens Solid Edge —
Siemens Spectrum Power 4 0
Siemens Spectrum Power 7 0
Siemens Spectrum Power TG 0
Siemens Supply Chain Suite —
Siemens Teamcenter —
Siemens Teamcenter Product Cost Management —
Siemens Teamcenter Visualization —
Siemens Tecnomatix Plant Simulation —
Siemens TestWay —
Siemens Valor NPI —
Siemens Xcargo —
Siemens Xpedition Designer —
Siemens Xpedition Enterprise —
Siemens Xpedition Enterprise XCR —
Siemens Xpedition IC Packaging —
Siemens Xpedition Layout Browser —

Ubuntu fixes

  • USN-8948-2 PHP vulnerabilities Ubuntu 20.04, 18.04, 16.04, 14.04 · 21.10.2026 · php5, php7.0, php7.2, php7.4
  • USN-8948-1 PHP vulnerabilities Ubuntu 26.10, 26.04, 24.04, 22.04 · 21.10.2026 · php8.1, php8.3, php8.5

References and patches

CPE matches (NVD) (60)
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 7.3.0 < 8.2.35
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.3.0 < 8.3.36
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.4.0 < 8.4.27
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.5.0 < 8.5.12
  • cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 10.2.0 < 10.2.7
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h10:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h11:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h13:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h14:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h15:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h17:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h2:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h20:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h22:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h23:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h24:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h32:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h34:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h35:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h36:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h37:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h38:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h4:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h5:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h7:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h9:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:*:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:*:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h13:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h14:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h17:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h18:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h21:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h27:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h30:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h31:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h36:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h37:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h39:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h40:*:*:*:*:*:*
  • cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h41:*:*:*:*:*:*

Recent CVEs in the same product — Ubuntu 20.04 LTS

9.2Critical
CVE-2026-111497 KEV

Out-of-Bounds Write in Google Brotli Decoder

Google Brotli; Siemens Heliox Dual Port 60kW; Siemens Heliox Flex Pro; Siemens SICHARGE FLEX

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

83%EPSS
9.2Critical
CVE-2026-109619 KEV

RCE via stale global state

PHP Group PHP; Siemens AX4; Siemens CADRA; Siemens Capital

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

100%EPSS
7.7High
CVE-2026-61642

Squid Request Smuggling in HTTP Transfer-Encoding

squid-cache squid

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accept…

2.0%EPSS
7.8High
CVE-2026-101258

Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Enterprise Linux 6

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document pa…