CVE-2026-109618
CRITICAL CISA KEV 710 PoCs
ACT NOW
Priority: 9.20
BB Relevance:
88/100
Published: 2026-10-21
Modified: 2026-10-29
First seen: 2026-10-29
Status: active
Attack Surface
Network
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
AT:
Present
VC:
High
VI:
High
VA:
High
Description
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
CISA Known Exploited Vulnerability
Vendor / Product
PHP Group — PHP
Date Added
2026-10-26
Remediation Due
2026-10-29
This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109618
Weakness Classification (5)
Affected Software (612)
| Vendor | Product | Version |
|---|---|---|
| PHP Group | PHP | 8.2.* < 8.2.35 |
| PHP Group | PHP | 8.3.* < 8.3.36 |
| PHP Group | PHP | 8.4.* < 8.4.27 |
| PHP Group | PHP | 8.5.* < 8.5.12 |
| PHP Group | PHP | 8.2.* < 8.2.35 |
| PHP Group | PHP | 8.3.* < 8.3.36 |
| PHP Group | PHP | 8.4.* < 8.4.27 |
| PHP Group | PHP | 8.5.* < 8.5.12 |
| PHP Group | PHP | 8.2.* < 8.2.35 |
| PHP Group | PHP | 8.3.* < 8.3.36 |
| PHP Group | PHP | 8.4.* < 8.4.27 |
| PHP Group | PHP | 8.5.* < 8.5.12 |
| PHP Group | PHP | 8.2.* < 8.2.35 |
| PHP Group | PHP | 8.3.* < 8.3.36 |
| PHP Group | PHP | 8.4.* < 8.4.27 |
| PHP Group | PHP | 8.5.* < 8.5.12 |
| paloaltonetworks | pan-os | 10.2.0 – 10.2.7 |
| paloaltonetworks | pan-os | 10.2.7 |
| paloaltonetworks | pan-os | 10.2.7 |
| paloaltonetworks | pan-os | 10.2.7 |
| paloaltonetworks | pan-os | 10.2.7 |
| paloaltonetworks | pan-os | 10.2.7 |
| paloaltonetworks | pan-os | 10.2.7 |
| paloaltonetworks | pan-os | 10.2.7 |
| paloaltonetworks | pan-os | 10.2.7 |
| paloaltonetworks | pan-os | 10.2.7 |
| paloaltonetworks | pan-os | 10.2.7 |
| paloaltonetworks | pan-os | 10.2.7 |
| paloaltonetworks | pan-os | 10.2.7 |
| paloaltonetworks | pan-os | 10.2.7 |
Showing 30 of 612 entries
References & Advisories (9)
US Government Resource
Third Party Advisory
Third Party Advisory
Third Party Advisory
Third Party Advisory
Mitigation
Vendor Advisory
Mailing List
Third Party Advisory
Mailing List
Third Party Advisory
Proof of Concept (710)
★ 20
nomi-sec
★ 1
nomi-sec
★ 1
nomi-sec
★ 1
nomi-sec
—
nomi-sec