CVE-2026-109618: PHP Memory Corruption Vulnerability

Official remediation direction

CISA due date: 2026-10-29. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Detection and validation

Confirm the exact affected build and component exposure, update from the vendor channel, review crash and restart telemetry, and keep network containment in place until the fixed process is running.

• Confirm the installed and running version of PHP Group PHP against the current vendor advisory.
• Check whether the vulnerable interface is reachable from untrusted networks or lower-privileged identities.
• Look for new accounts, privilege changes, crashes, child processes, or unusual outbound traffic associated with the component.
• Run a post-remediation service and security-control health check and retain evidence with the change record.

Accuracy note

Severity, affected-version ranges, and remediation details can change as the vendor and vulnerability databases add evidence. Recheck the linked primary records before closing the incident or approving a long-lived exception.

Primary sources and references

• CISA Known Exploited Vulnerabilities: CVE-2026-109618: PHP Memory Corruption Vulnerability
• NIST National Vulnerability Database: CVE-2026-109618: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context…
• CISA Cybersecurity Advisories: Critical Vulnerabilities in PHP Require Immediate Patching
• Palo Alto Networks Security Advisories: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)
• Cisco Security Advisories: Vulnerabilities in PHP Affecting Cisco Products: October 2026