CVE-2026-109618 PHP Memory Corruption
- Exploited in the wild
- Since 26 Oct 2026
- Fix
- Available
What is CVE-2026-109618?
CVE-2026-109618 is a critical vulnerability in Paloaltonetworks Pan-Os, published on 21 Oct 2026.
Official description
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Which versions are affected by CVE-2026-109618?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 7.3.0 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
php Bitnami | From 7.3.0 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
php-min Bitnami | From 7.3.0 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
Linux distribution packages (1)
matomo openSUSE:Tumbleweed | All versions | 5.14.2-1.1 |
Products include Paloaltonetworks Pan-Os, Paloaltonetworks Panorama Virtual Appliance, Php Php, Siemens Ruggedcom Ape1808 Firmware.
How do I fix CVE-2026-109618?
Upgrade libphp to a fixed version for your release line: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. US federal agencies must fix it by 29 Oct 2026.
Is CVE-2026-109618 being exploited?
Yes. Attackers have exploited CVE-2026-109618 in the wild since at least 26 Oct 2026.
Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 725 proofs of concept on GitHub.
Other vulnerabilities in Paloaltonetworks Pan-Os
- CVE-2024-3400 Palo Alto Networks PAN-OS Command Injection
- CVE-2020-2021 Palo Alto Networks PAN-OS Authentication Bypass
- CVE-2017-15944 Palo Alto Networks PAN-OS Remote Code Execution
- CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds Write
- CVE-2024-0012 Palo Alto Networks PAN-OS Management Interface Authentication Bypass
Sources
Also known as AZL-109815, BELL-CVE-2026-109618, BIT-libphp-2026-109618, BIT-php-2026-109618, BIT-php-min-2026-109618, CLEANSTART-2026-LE11033 and 9 more.