CVE-2026-109618 is a PHP engine flaw with an awkward but dangerous trigger: make the server run out of memory at precisely the wrong point in processing a request. PHP is the server-side runtime behind websites, CMS deployments, ecommerce services, APIs and application back ends, and it is also embedded in appliance management consoles and security products. That means the people who run it range from web-platform teams to firewall and infrastructure administrators who may not even manage PHP directly.
PHP’s October 21 advisory confirms unauthenticated remote code execution against Apache mod_php and considers FPM susceptible, although it says a complete FPM exploit had not been demonstrated. The related CVE-2026-109619 concerns a different failure mode involving stale global pointers; both are commonly discussed as PHP2Shell.
An OOM bailout leaves unsafe request state
When an allocation fails, PHP can use longjmp() to escape the current work and abort the request. In the vulnerable path, that jump can happen after internal request data has become reachable but before it is fully initialized. Request shutdown then reads or branches on that invalid state as though it were legitimate. This is a use-after-free/state-corruption problem, not an application-level bug in a site’s PHP code.
An unauthenticated remote attacker needs to reach a PHP web-serving interface and send requests capable of driving the process into an out-of-memory condition. The demonstrated mod_php risk is especially consequential because the failure can occur during request parsing, before application code runs. PHP says web-facing SAPIs potentially at risk include FPM, mod_php, CGI, FrankenPHP and LiteSpeed; the precise reliability of exploitation depends on the PHP release, operating system and web-server combination.
Scanning started before the disclosure
This is not a theoretical edge case. Honeypot telemetry recorded an attempted attack on October 17, before the October 21 disclosure, then broader activity after publication. The telemetry could not establish whether that pre-disclosure attempt would have succeeded against a production target. Public proof-of-concept and exploit code exists, but individual repositories vary: some confuse the OOM path in CVE-2026-109618 with CVE-2026-109619, and public exploits have not been broadly reliable across environments.
As of October 25, CVE-2026-109618 was not listed in CISA’s KEV catalogue; independent confirmation from CISA’s feed was unavailable because it returned HTTP 403 during research. There is also no authoritative public report tying this CVE to a conclusively compromised production organisation.
Patch the runtime—and the appliance that carries it
Upgrade supported PHP branches to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. PHP 8.1 and older have no normal upstream fixed release; source backports exist for 7.4, 8.0 and 8.1, but migration to a supported branch is the cleaner route. Setting memory_limit=-1 where applications cannot override it is a temporary mitigation, not a complete fix: allocator failures can still reach the vulnerable path.
For embedded deployments, customers need the vendor’s update rather than a standalone PHP package. Palo Alto Networks identifies affected PAN-OS HTTPS management interfaces and XML API on PA-Series and VM-Series firewalls and Panorama appliances; GlobalProtect and Captive Portal are not affected. Its product advisory lists already-fixed and scheduled hotfixes by PAN-OS maintenance line, while Bridgecrew, Cloud NGFW and Cortex XDR Agent are listed as unaffected.
Inventory every internet- and intranet-reachable PHP SAPI, restrict management interfaces, and apply the appropriate runtime or firmware fix quickly. SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs, which matters when a language-runtime defect arrives through products teams may not realise embed it.
