CVE-2026-109618
criticalpriority · attend · 53EPSS 0.116 · 96 %ileexploit · PoCCHDEFRNLRUUSEPSS · scored 2026-10-23
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedABB Manufacturing Execution System (MES) installed with Dokuwikiabb_psirt
The vulnerabilities are not tight to any specific MES version but solely depend on the delivery including Dokuwiki, which relies on affected PHP versions. The affected PHP versions are listed in CERT-EU - Critical Vulnerabilities in PHP Reference section. The problem is corrected in the following product versions: • PHP 8.5.12 • PHP 8.4.27 • PHP 8.3.36 • PHP 8.2.35 ABB recommends that customers apply the updates immediately. The updates are applied by updating the PHP packages in operating system of the servers that run Dokuwiki. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. PHP is installed on the web server / operating system, so upgrading PHP is a server administration task. It needs to be checked which PHP packages are installed on the system, and upgrade them (depending on the OS, with either ‘dnf’ or ‘yum’). ABB recommends that only PHP packages are updated, not the whole Dokuwiki installation.
- FixedAPROLabb_psirt
B&R is actively working on patch versions for affected products. Based on current planning, these are expected to be released on October 26, 2026 (for R 4.4-65) and October 29, 2026 (for R 4.4-01). B&R will up-date this advisory if these dates change. APROL is intended to be operated only in environments with restricted logical and physical access, as described in the product documentation and in “Defense in Depth for B&R products”. Until patches are available and installed, B&R recommends that customers restrict HTTP(S) traffic to the APROL system, particularly from untrusted networks, and implement additional security measures to limit access to the product to trusted personnel. We advise customers to review and validate their current access re-strictions to confirm that logical and physical access controls are configured in line with these recom-mendations. These measures reduce, but may not fully eliminate, the risk of exploitation.
- FixedRUGGEDCOM APE1808siemens_psirt
Contact customer support to receive patch and update information
- Fixedphp-srccisa_csaf_it
Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w - MitigationABB Manufacturing Execution System (MES) installed with Dokuwikiabb_psirt
Updating to a release containing the patches is the only complete and reliable mitigation. You should immediately update the PHP component in Dokuwiki to one of the following: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP is installed on the web server / operating system, so upgrading PHP is a server administration task. • To check the version of PHP: use ‘php -v’ (as ‘root’). • The exact names and availability of individual PHP packages vary by distribution release. To see the list of installed PHP packages: dnf list installed 'php*'. o Typical package names on RHEL-family systems look like: - php - php-cli - php-common - php-gd - php-intl - php-mbstring - php-opcache - php-pdo - php-xml - (there might be other PHP packages, as well) Refer to section “General security recommendations” for further advise on how to keep your system secure.
- MitigationAPROLabb_psirt
APROL is intended to be operated only in environments with restricted logical and physical access, as described in the product documentation and in “Defense in Depth for B&R products”. Until patches are available and installed, B&R recommends that customers implement additional security measures to limit access to the product to trusted personnel. We advise customers to review and validate their cur-rent access restrictions to confirm that logical and physical access controls are configured in line with these recommendations. These measures reduce, but may not fully eliminate, the risk of exploitation. It is recommended to block any HTTP(S) traffic, particularly from untrusted networks, reaching the APROL system on your connected firewalls. Refer to section “General security recommendations” for further advise on how to keep your system secure.
- WorkaroundABB Manufacturing Execution System (MES) installed with Dokuwikiabb_psirt
The only workaround, while patches are not installed, is to temporarily shut down the Dokuwiki server(s).
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.1–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (582)
Public proof-of-concept and weaponised exploit code.
- 0k1dok1/CVE-2026-109618-CHECK0k1dok1/CVE-2026-109618-CHECKPoC · poc_in_github
- 0ldbaby/php2shellCVE-2026-109618 / CVE-2026-109619PoC · poc_in_github
- 0xBlackash/CVE-2026-109618CVE-2026-109618PoC · poc_in_github
affected products (143)
Products and version ranges known to be affected.
advisories (15)
Vendor and ecosystem advisories describing this.
- 4hzk000017ABB Manufacturing Execution System- PHP Vulnerabilities in DokuWiki installations2026-10-23csaf · abb_psirtCH
ABB is aware of publicly reported vulnerabilities in the product listed as affected in the advisory. Updates to the affected component that fixed the vulnerabilities are available. An attacker who successfully exploited this vulnerability could remotely execute code on the server run-ning Dokuwiki. No active exploitations of the vulnerabilities have been reported by the time of writing this document
- NCSC-2026-0443Kwetsbaarheden verholpen in PHPNL2026-10-21csaf · ncsc_nlNL
PHP heeft twee kritieke kwetsbaarheden verholpen. De kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt voor het uitvoeren van willekeurige code. Alle PHP-installaties die webverzoeken verwerken zijn getroffen.
- SA26P015APROL Impact of PHP2Shell2026-10-23csaf · abb_psirtCH
B&R is aware of public reports of a vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploits these vulnerabilities may insert and run arbitrary code on affected devices.
- SSA-566435SSA-566435: PHP2Shell Vulnerabilities in Siemens Software Products2026-10-23csaf · siemens_psirtDE
On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.
- SSA-566512SSA-566512: PHP2Shell Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices2026-10-23csaf · siemens_psirtDE
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS related to PHP2Shell vulnerabilities. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. [1] https://security.paloaltonetworks.com/CVE-2026-109618
- VA-26-295-01PHP insecure error handling and state management2026-10-21csaf · cisa_csaf_itUS
PHP insecurely handles multiple combinations of memory allocations and error conditions. These behaviors can allow a remote attacker to cause a denial of service or execute arbitrary code. Successful exploitation depends on a number of factors including the specific PHP application being targeted, the SAPI and web server, error handling and memory resource configuration, and platform or OS-level memory protections. Without significant analysis effort to prove otherwise, any application running on a vulnerable version of PHP should be considered vulnerable and exploitable.
- WID-SEC-W-2026-4055PHP: Mehrere Schwachstellen ermöglichen CodeausführungDeutsch2026-10-20csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um Speicherinhalte offenzulegen, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.
- BIT-libphp-2026-109618RCE via OOM corruption2026-10-22vendor · osvUS
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
- BIT-php-2026-109618RCE via OOM corruption2026-10-22vendor · osvUS
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
- BIT-php-min-2026-109618RCE via OOM corruption2026-10-22vendor · osvUS
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
- CERTFR-2026-AVI-1359Multiples vulnérabilités dans PHPFrançais2026-10-21vendor · certfrFR
- CERTFR-2026-AVI-1360Multiples vulnérabilités dans les produits CiscoFrançais2026-10-22vendor · certfrFR
- CERTFR-2026-AVI-1369Multiples vulnérabilités dans les produits HPE Aruba NetworkingFrançais2026-10-23vendor · certfrFR
- CERTFR-2026-AVI-1370Multiples vulnérabilités dans les produits TenableFrançais2026-10-23vendor · certfrFR
- VU#763488CERT/CC Vulnerability Note VU#7634882026-10-22vendor · cert_cc_vinceUS
also known as (5)
Other names and identifiers for this entity.
- BDU:2026-17191fstec_bdu
- GHSA-w8hw-w9fx-j79wfstec_bdu
- BIT-libphp-2026-109618osv
- BIT-php-2026-109618osv
- BIT-php-min-2026-109618osv
sources
Which sources assert this record, and when.
references (5) nvd
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/10/21/6Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/23/5Mailing ListThird Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-566512.htmlThird Party Advisory
- https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79wMitigationVendor Advisory
- https://www.wiz.io/blog/php2shell-php-rceThird Party Advisory
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan