PHP CVE-2026-109618: critical RCE exploited in the wild

What the flaw is and who it affectsCVE-2026-109618, published in the NIST National Vulnerability Database on 21 October 2026, is a memory corruption v...

What the flaw is and who it affects

CVE-2026-109618, published in the NIST National Vulnerability Database on 21 October 2026, is a memory corruption vulnerability in PHP Group PHP, officially named PHP Memory Corruption Vulnerability. According to the NVD, PHP uses longjmp() to exit the current context on out-of-memory (OOM) errors and abort handling of the request. Some contexts do not properly account for this scenario and leave request memory uninitialised before an allocation; the subsequent request cleanup procedure may then read or branch on that memory. Multiple OOM strategies can consistently trigger the condition and lead to remote code execution.

CISA summarises it more bluntly: an out-of-memory corruption vulnerability that allows unauthenticated remote code execution. The severity is CVSS 4.0 9.2, CRITICAL, mapped to CWE-416, CWE-755, CWE-824 and CWE-1325.

The affected PHP branches listed by the NVD are:

from 7.3.0 (included) up to, but not including, 8.2.35
from 8.3.0 (included) up to, but not including, 8.3.36
from 8.4.0 (included) up to, but not including, 8.4.27
from 8.5.0 (included) up to, but not including, 8.5.12

The NVD also lists downstream products that embed the affected runtime, including Siemens RUGGEDCOM APE1808 firmware and a long series of Palo Alto Networks PAN-OS releases (10.2.0 up to 10.2.7, plus the 10.2.7 h1 to h13 hotfixes and further configurations). In practice this is not only a question of the PHP binary on a web server: any appliance or platform that bundles PHP inherits the exposure.

For businesses in Catalonia and across Spain, the practical question is simple. PHP runs behind a very large share of WordPress, PrestaShop and Joomla sites, internal tools and legacy applications on own servers. If nobody in the company tracks which PHP version is running where, this CVE is invisible until it is used.

Why it is urgent

This is not a theoretical flaw awaiting a proof of concept. CISA added CVE-2026-109618 to its Known Exploited Vulnerabilities (KEV) catalogue on 26 October 2026, which means it has been observed exploited in real attacks. CISA gave US federal agencies until 29 October 2026 to remediate — three days.

The action CISA requires is to apply mitigations in accordance with vendor instructions, in line with its BOD 26-04 guidance on prioritising security updates by risk and its forensics triage requirements; where mitigations are unavailable for cloud services, the guidance points to discontinuing use of the product. CISA also places responsibility on each organisation to evaluate the internet exposure of every asset. The KEV entry does not record known use in ransomware campaigns.

The combination is what makes it serious: unauthenticated, remotely exploitable, critical severity, already in the wild, and present in a runtime that many companies never inventory. An unpatched PHP install reachable from the internet is an entry point that does not need credentials.

What to do today

Inventory. Establish which systems run PHP and at which exact version: web servers, containers, staging environments, internal applications, and any appliance or platform whose documentation mentions an embedded PHP runtime. Check the PAN-OS and Siemens RUGGEDCOM references against what you actually have deployed.
Patch per the vendor advisory. The PHP project's security advisory (GHSA-w8hw-w9fx-j79w) is the authoritative source for the mitigation and the fixed versions. Apply exactly what the manufacturer states for your branch — do not assume that a version number seen elsewhere is the corrected one.
Look for signs of intrusion. Because exploitation can lead to remote code execution, updating alone is not enough if the system was already reachable. Review logs, unexpected files, scheduled tasks, new accounts and outbound connections on any host that ran an affected version while exposed. CISA's forensics triage requirements are a useful checklist even outside the US federal context.
Reduce what is exposed. Close direct internet access to PHP-FPM, admin panels and diagnostic endpoints that do not need to be public, and put the rest behind a reverse proxy or VPN. Fewer reachable services means fewer ways in while patching is completed.
Keep the CMS layer current. WordPress, PrestaShop and Joomla installations inherit the risk of the PHP version underneath them; a hardened CMS on an outdated runtime is still exposed.

How a cybersecurity team such as ALMC's can help

Most SMEs and online shops we work with in Lleida, Barcelona, Tarragona and Girona do not have a full-time security function, and their IT team is small. That is usually where this kind of CVE slips through: nobody owns the inventory, so nobody knows which server is on an affected branch.

Our work starts with visibility — security audits and pentesting to map what is actually exposed, hardening of servers and PHP configurations, and monitoring with incident response so that anomalous behaviour on a host is detected rather than discovered months later. We also handle the maintenance and updating of WordPress, PrestaShop and Joomla, which is where the runtime version and the CMS version have to move together, and we repair websites that have already been compromised. When a critical CVE like this one lands in the KEV catalogue, the difference is whether someone can answer, within the hour, which systems are affected and what version they run.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.