{"id":"EM-20261029-S1FJ","url":"https://cyber.eventmonitor.net/incident/EM-20261029-S1FJ/","type":"cve","title":"PHP Memory Corruption Vulnerability","subtitle":"CVE-2026-109618","subject":"CVE-2026-109618","status":"Confirmed","severity":"high","affected":["PHP Group PHP"],"headline":"21 hours from first report to confirmed exploitation.","born":"2026-10-29T08:40:28.202Z","firstSignal":"2026-10-28T12:00:00.000Z","lastSignal":"2026-10-30T16:46:49.009Z","updated":"2026-11-04T09:24:33.782Z","revision":4,"life":[{"status":"Born","at":"2026-10-29T08:40:28.202Z","why":"second independent source: C123 Provider status pages (Statuspage)"},{"status":"Developing","at":"2026-10-29T08:40:28.202Z","why":"signals keep joining"},{"status":"Confirmed","at":"2026-10-29T08:40:28.202Z","why":"CISA added it to Known Exploited Vulnerabilities"}],"changeLog":[{"at":"2026-10-28T12:00:00.000Z","what":"First signal: C1 CISA Known Exploited Vulnerabilities"},{"at":"2026-10-29T08:40:28.202Z","what":"Born: second source, C123 Provider status pages (Statuspage). Page EM-20261029-S1FJ created."},{"at":"2026-10-29T08:40:28.202Z","what":"Status: Confirmed (CISA added it to Known Exploited Vulnerabilities)"},{"at":"2026-10-29T18:00:34.000Z","what":"Source joined: C143 Palo Alto Unit 42"},{"at":"2026-10-29T23:54:00.000Z","what":"Source joined: C45 Palo Alto Networks Security Advisories"},{"at":"2026-10-30T16:46:49.009Z","what":"Source joined: C56 AlienVault OTX pulses"}],"stages":[{"name":"Disclosed","at":"2026-10-21T14:17:09.357Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-10-21T14:17:09.357Z","detail":"CVSS 9.2 · EPSS 100.0%"},{"name":"Exploited","at":"2026-10-29T08:40:28.202Z","detail":"C1 CISA KEV, fix by 2026-10-29"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-10-29T23:54:00.000Z","detail":"C45 published"},{"name":"Resolved","at":null,"detail":"When fixed: KEV deadline 2026-10-29, then 14 quiet days"}],"signals":[{"at":"2026-10-28T12:00:00.000Z","source":"C1","sourceName":"CISA Known Exploited Vulnerabilities","role":"Exploited List","severity":3,"title":"CVE-2026-46300 added to KEV: Linux Kernel Mi ing Initialization of a Variable Vulnerability","text":"Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"at":"2026-10-29T08:40:28.202Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Linode: Cu tomer Security Advi ory: PHP Remote Code Execution Vulnerabilitie","text":"postmortem. On October 10, 2026, Akamai became aware of two zero-day remote code execution \\(RCE\\) vulnerabilities affecting the PHP core engine, tracked as CVE-2026-109618 and CVE-2026-109619. Akamai began a platform-wide investigation, and deployed global Web Applicatio","url":"https://stspg.io/5yrzq18zhvjz"},{"at":"2026-10-29T18:00:34.000Z","source":"C143","sourceName":"Palo Alto Unit 42","role":"Research & News","severity":2,"title":"Threat Brief: Critical Vulnerabilitie  in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)","text":"CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) appeared first on Unit 42 .","url":"https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/"},{"at":"2026-10-29T23:54:00.000Z","source":"C45","sourceName":"Palo Alto Networks Security Advisories","role":"Vendor","severity":3,"title":"CVE-2026-109618 Impact of Critical Vulnerabilitie  in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Network  Product  (Severity: CRITICAL)","text":null,"url":"https://security.paloaltonetworks.com/CVE-2026-109618"},{"at":"2026-10-30T16:46:49.009Z","source":"C56","sourceName":"AlienVault OTX pulses","role":"Research & News","severity":2,"title":"PHP2Shell One Week Later: Honeypot Shell  on the Web, a Path to Root on Palo Alto Firewall","text":"PHP2Shell emerged from two critical PHP memory-safety vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2 and patched on October 21, 2026. Investigation of open directories uncovered 616 PHP2Shell-related files revealing widespread exploit development across multiple operators. Whil","url":"https://otx.alienvault.com/pulse/6ae4c9f97b4e07a268c06b96"}],"crowd":[],"reference":{"nvd":{"published":"2026-10-21T14:17:09.357","score":9.2,"severity":"CRITICAL","desc":"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may r","product":"Php","seen":1793783074499},"kev":{"added":"2026-10-26","due":"2026-10-29","ransomware":"Unknown","vendor":"PHP Group","product":"PHP","name":"PHP Memory Corruption Vulnerability"},"epss":{"epss":0.99999,"pct":0.99998,"at":1793783074499},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}