CVE-2026-109618: exploitation status and patch state CVE-2026-109618 · CVSS 9.8 CRITICAL · EPSS 100.0% · patch available
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Is CVE-2026-109618 exploited? Not in the CISA KEV catalog. EPSS puts exploitation in the next 30 days at 100.0%. Public exploit code: functional. Public detection rules exist. Which products and versions are affected? PHP Group · PHP · >= 8.2.*, < 8.2.35, >= 8.3.*, < 8.3.36, >= 8.4.*, < 8.4.27, >= 8.5.*, < 8.5.12 siemens · ruggedcom ape1808 firmware paloaltonetworks · pan-os · >= 10.2.0, < 10.2.7, 10.2.7, 10.2.8, 10.2.9, 10.2.10, 10.2.11, +44 more paloaltonetworks · panorama virtual appliance Is there a patch? Yes. Update to one of these or later:
PHP 8.2.* 8.2.35 PHP 8.3.* 8.3.36 PHP 8.4.* 8.4.27 PHP 8.5.* 8.5.12
From PHP Group's CVE record · PHP Group advisory
pan-os 10.2.0 10.2.7 pan-os 11.1.0 11.1.4 pan-os 11.2.0 11.2.4 pan-os 12.1.0 12.1.4 pan-os 12.2.0 12.2.4
From NVD's analysis
What PlainSec published about CVE-2026-109618 Primary sources KEV and EPSS are re-checked daily. Record last updated 2026-10-26.
CVE-2026-109618: exploitation status and patch state CVE-2026-109618 · CVSS 9.8 CRITICAL · EPSS 100.0% · patch available
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Is CVE-2026-109618 exploited? Not in the CISA KEV catalog. EPSS puts exploitation in the next 30 days at 100.0%. Public exploit code: functional. Public detection rules exist. Which products and versions are affected? PHP Group · PHP · >= 8.2.*, < 8.2.35, >= 8.3.*, < 8.3.36, >= 8.4.*, < 8.4.27, >= 8.5.*, < 8.5.12 siemens · ruggedcom ape1808 firmware paloaltonetworks · pan-os · >= 10.2.0, < 10.2.7, 10.2.7, 10.2.8, 10.2.9, 10.2.10, 10.2.11, +44 more paloaltonetworks · panorama virtual appliance Is there a patch? Yes. Update to one of these or later:
PHP 8.2.* 8.2.35 PHP 8.3.* 8.3.36 PHP 8.4.* 8.4.27 PHP 8.5.* 8.5.12
From PHP Group's CVE record · PHP Group advisory
pan-os 10.2.0 10.2.7 pan-os 11.1.0 11.1.4 pan-os 11.2.0 11.2.4 pan-os 12.1.0 12.1.4 pan-os 12.2.0 12.2.4
From NVD's analysis
What PlainSec published about CVE-2026-109618 Primary sources KEV and EPSS are re-checked daily. Record last updated 2026-10-26.