cyber.hendryadrian.com
Vulnerability & Exploit · unit42.paloaltonetworks.com

Critical PHP RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Expose Millions of Instances

· Original article ↗

Summary

Unit 42 describes two critical PHP RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and urges immediate patching. Palo Alto Networks telemetry found over 22.6 million potentially vulnerable exposed instances.

Key points

  • Both vulnerabilities are rated 9.2 under CVSS 4.0 and allow remote code execution.
  • CVE-2026-109618 can leave request memory uninitialized after out-of-memory errors handled through longjmp().
  • CVE-2026-109619 can leave global memory pointing to freed regions, which later requests may read or branch on.
  • Unit 42 says it has seen proof of concept; the article does not report confirmed exploitation.
  • Palo Alto Networks telemetry identified over 22.6 million exposed instances potentially vulnerable to the flaws.
  • The article says at least one European government took its website offline as a precaution.
  • PHP urges patching; Palo Alto Networks lists product protections, including a firewall virtual patch available since October 20, 2026.

Article Details

Vulnerability Types
  • Remote code execution
  • Improper control flow handling leaves request memory uninitialized during out-of-memory error handling
  • Global memory pointer can reference freed memory during subsequent requests
Severity
Critical; CVSS 4.0 score 9.2 for both vulnerabilities.
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
unknown

CVE

CVE-2026-109618Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.CVE-2026-109619Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.

Vendors

Palo Alto NetworksPalo Alto Networks has evaluated our product portfolio regarding this issue.PHP GroupWe encourage reviewing the PHP Group’s security advisory and patching guidance.

Products

Cortex CloudCortex XDR, Cortex Cloud and XSIAMCortex XDRCortex XDR and XSIAMCortex XpanseAt the time of publication, Palo Alto Networks Cortex Xpanse has identified the presence of over 22.6 million exposed instances potentially vulnerable to CVE-2026-109618 and CVE-2026-109619 based on our telemetry.Next-Generation FirewallNext-Generation Firewall with the following security subscriptions can help block the attacks:PHPUnit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619.Prisma CloudCortex Cloud and Prisma CloudXSIAMCortex XDR and XSIAM

Related Articles