Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

CISA KEV lists PHP memory-corruption flaw enabling unauthenticated RCE

Original title: CISA KEV: PHP Memory Corruption Vulnerability — PHP Group PHP (CVE-2026-109618)

CISA Known Exploited Vulnerabilities ()1 min read
Read at cisa.gov
Part of a story covered by 21 sourcesCISA lists exploited PHP2Shell flaws; agencies must patch by Oct. 29Merged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

CVE-2026-109618 is an out-of-memory corruption bug; federal due date is October 29, and ransomware use is unknown.

CISA added CVE-2026-109618 to the Known Exploited Vulnerabilities catalog. PHP Group PHP has an out-of-memory corruption vulnerability that allows unauthenticated remote code execution. Required action is to apply vendor mitigations under BOD 26-04, or stop using the product if mitigations are unavailable. The catalog due date is October 29, 2026. Known ransomware campaign use is listed as unknown.

Unconfirmed: CISA lists known ransomware campaign use as unknown.

Key facts
  • Unauthenticated remote code execution via out-of-memory corruption.
  • KEV due date is October 29, 2026.
  • Known ransomware campaign use is unknown.
  • Apply vendor mitigations or discontinue the product.
Security assessment · AI, from the articleExploited in the wild

Impact: Unauthenticated remote code execution

ProductAffected
PHP Group PHP—
What to do
  1. 1.Apply mitigations per vendor instructions and CISA BOD 26-04.
  2. 2.Discontinue use if mitigations are unavailable.
  3. 3.Evaluate internet exposure and meet the October 29, 2026 due date.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-109618
ATT&CK
T1190 Exploit Public-Facing Application
Tags
phpcisa-kevremote-code-executionmemory-corruption
Vendors
PHP Group
Products
PHP
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV

From the original article

1 min read at cisa.gov

PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.