ZeroDayAlert

CVE-2026-109618: PHP Memory Corruption Vulnerability

PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.

PHP Group PHP Added to KEV 2026-10-26 Federal due 2026-10-29 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

PHP Group's PHP product contains an out-of-memory corruption vulnerability that permits unauthenticated remote code execution. The record does not specify which PHP versions are affected, which deployment contexts (command-line, web server modules, containerised environments, embedded systems) are most at risk, or whether certain PHP configurations are prerequisites for exploitation. You should assume any PHP installation exposed to untrusted network input is a candidate for review.

How to check whether this touches you

  • Inventory all systems running PHP: check application dependencies, web server configurations, and any third-party software that bundles PHP.
  • Establish network reachability: determine whether each PHP instance accepts HTTP requests, processes user uploads, or runs SAPI handlers (php-fpm, mod_php, FastCGI) accessible from outside your network perimeter.
  • Query the running PHP version on each instance using php -v (command-line) or by inspecting HTTP response headers, phpinfo() output, or error pages; version alone is a signal of potential exposure, not proof, because some distributions backport fixes to older release branches.
  • Review recent access logs and request patterns for signs of exploitation attempts or anomalous memory consumption before the record's publication date (2026-10-26).

What to do

  1. Consult the PHP Group's security advisory and vendor patch guidance immediately; apply any released update to all affected PHP installations according to CISA's BOD 26-04 timeline (federal remediation due 2026-10-29).
  2. If a patch is unavailable or testing delays deployment, isolate PHP instances from direct internet access using firewalls, network segmentation, or reverse-proxy rules that restrict input size and request patterns.
  3. Enable PHP-level memory limits and execution timeouts; monitor memory usage, CPU spikes, and process crashes for signs of exploitation attempts.
  4. Preserve access logs and application logs from before the vulnerability record publication date; configure centralized logging if not already in place.
  5. If you cannot patch or mitigate within your risk tolerance, follow BOD 26-04 guidance for your sector and discontinue the product if no mitigations are available.

If you find you were exposed

Exploitation of out-of-memory corruption flaws typically leaves indirect traces: memory dumps may be gone, but abnormal process terminations, segmentation faults, or core files preceding the vulnerability disclosure may indicate prior compromise attempts. Search your logs for the earliest sign of anomalous PHP process behaviour and cross-correlate with network ingress logs to narrow the attack window. If logs predate the disclosure by weeks or months, prioritise recovery of any backup logs from that period and engage forensics support if code execution is suspected.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-109618 is being exploited. It cannot tell you whether PHP is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →