CVE-2026-109618

CRITICAL9.2Memory safety

ExploitNews

Description

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVSS breakdown

CVSS 4.0

Attack Vector

Network

Attack Complexity

High

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Confidentiality (Vulnerable System)

High

Integrity (Vulnerable System)

High

Availability (Vulnerable System)

High

Confidentiality (Subsequent System)

None

Integrity (Subsequent System)

None

Availability (Subsequent System)

None

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products

paloaltonetworks / panorama_virtual_appliance
paloaltonetworks / pan-os11.2.10 – 11.2.10
paloaltonetworks / pan-os12.1.8 – 12.1.8
paloaltonetworks / pan-os12.1.9 – 12.1.9
paloaltonetworks / pan-os12.1.10 – 12.1.10
paloaltonetworks / pan-os12.1.10 – 12.1.10
paloaltonetworks / pan-os12.2.4 – 12.2.4
paloaltonetworks / pan-os
paloaltonetworks / pan-os10.2.0 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.7 – 10.2.7
paloaltonetworks / pan-os10.2.8 – 10.2.8
paloaltonetworks / pan-os10.2.9 – 10.2.9
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.10 – 10.2.10
paloaltonetworks / pan-os10.2.11 – 10.2.11
paloaltonetworks / pan-os10.2.12 – 10.2.12
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.13 – 10.2.13
paloaltonetworks / pan-os10.2.14 – 10.2.14
paloaltonetworks / pan-os10.2.15 – 10.2.15
paloaltonetworks / pan-os10.2.16 – 10.2.16
paloaltonetworks / pan-os10.2.16 – 10.2.16
paloaltonetworks / pan-os10.2.16 – 10.2.16
paloaltonetworks / pan-os10.2.16 – 10.2.16
paloaltonetworks / pan-os10.2.16 – 10.2.16
paloaltonetworks / pan-os10.2.16 – 10.2.16
paloaltonetworks / pan-os10.2.16 – 10.2.16
paloaltonetworks / pan-os10.2.16 – 10.2.16
paloaltonetworks / pan-os10.2.16 – 10.2.16
paloaltonetworks / pan-os10.2.17 – 10.2.17
paloaltonetworks / pan-os10.2.18 – 10.2.18
paloaltonetworks / pan-os10.2.18 – 10.2.18
paloaltonetworks / pan-os10.2.18 – 10.2.18
paloaltonetworks / pan-os10.2.18 – 10.2.18
paloaltonetworks / pan-os10.2.18 – 10.2.18
paloaltonetworks / pan-os10.2.18 – 10.2.18
paloaltonetworks / pan-os10.2.18 – 10.2.18
paloaltonetworks / pan-os10.2.18 – 10.2.18
paloaltonetworks / pan-os10.2.18 – 10.2.18
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.4 – 11.1.4
paloaltonetworks / pan-os11.1.5 – 11.1.5
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.6 – 11.1.6
paloaltonetworks / pan-os11.1.7 – 11.1.7
paloaltonetworks / pan-os11.1.7 – 11.1.7
paloaltonetworks / pan-os11.1.7 – 11.1.7
paloaltonetworks / pan-os11.1.7 – 11.1.7
paloaltonetworks / pan-os11.1.7 – 11.1.7
paloaltonetworks / pan-os11.1.7 – 11.1.7
paloaltonetworks / pan-os11.1.7 – 11.1.7
paloaltonetworks / pan-os11.1.7 – 11.1.7
paloaltonetworks / pan-os11.1.8 – 11.1.8
paloaltonetworks / pan-os11.1.9 – 11.1.9
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.10 – 11.1.10
paloaltonetworks / pan-os11.1.11 – 11.1.11
paloaltonetworks / pan-os11.1.12 – 11.1.12
paloaltonetworks / pan-os11.1.13 – 11.1.13
paloaltonetworks / pan-os11.1.13 – 11.1.13
paloaltonetworks / pan-os11.1.13 – 11.1.13
paloaltonetworks / pan-os11.1.13 – 11.1.13
paloaltonetworks / pan-os11.1.13 – 11.1.13
paloaltonetworks / pan-os11.1.13 – 11.1.13
paloaltonetworks / pan-os11.1.13 – 11.1.13
paloaltonetworks / pan-os11.1.13 – 11.1.13
paloaltonetworks / pan-os11.1.13 – 11.1.13
paloaltonetworks / pan-os11.1.13 – 11.1.13
paloaltonetworks / pan-os11.1.13 – 11.1.13
paloaltonetworks / pan-os11.1.13 – 11.1.13
paloaltonetworks / pan-os11.1.13 – 11.1.13
paloaltonetworks / pan-os11.1.14 – 11.1.14
paloaltonetworks / pan-os11.1.15 – 11.1.15
paloaltonetworks / pan-os11.1.16 – 11.1.16
paloaltonetworks / pan-os11.1.16 – 11.1.16
paloaltonetworks / pan-os11.1.16 – 11.1.16
paloaltonetworks / pan-os11.1.16 – 11.1.16
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.4 – 11.2.4
paloaltonetworks / pan-os11.2.5 – 11.2.5
paloaltonetworks / pan-os11.2.6 – 11.2.6
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.7 – 11.2.7
paloaltonetworks / pan-os11.2.8 – 11.2.8
paloaltonetworks / pan-os11.2.9 – 11.2.9
paloaltonetworks / pan-os11.2.10 – 11.2.10
paloaltonetworks / pan-os11.2.10 – 11.2.10
paloaltonetworks / pan-os11.2.10 – 11.2.10
paloaltonetworks / pan-os11.2.10 – 11.2.10
paloaltonetworks / pan-os11.2.10 – 11.2.10
paloaltonetworks / pan-os11.2.10 – 11.2.10
paloaltonetworks / pan-os11.2.10 – 11.2.10
paloaltonetworks / pan-os11.2.10 – 11.2.10
paloaltonetworks / pan-os11.2.10 – 11.2.10
paloaltonetworks / pan-os11.2.10 – 11.2.10
paloaltonetworks / pan-os11.2.10 – 11.2.10
paloaltonetworks / pan-os11.2.10 – 11.2.10
paloaltonetworks / pan-os11.2.11 – 11.2.11
paloaltonetworks / pan-os11.2.12 – 11.2.12
paloaltonetworks / pan-os11.2.13 – 11.2.13
paloaltonetworks / pan-os11.2.13 – 11.2.13
paloaltonetworks / pan-os11.2.13 – 11.2.13
paloaltonetworks / pan-os11.2.13 – 11.2.13
paloaltonetworks / pan-os11.2.15 – 11.2.15
paloaltonetworks / pan-os11.2.16 – 11.2.16
paloaltonetworks / pan-os12.1.4 – 12.1.4
paloaltonetworks / pan-os12.1.4 – 12.1.4
paloaltonetworks / pan-os12.1.4 – 12.1.4
paloaltonetworks / pan-os12.1.4 – 12.1.4
paloaltonetworks / pan-os12.1.4 – 12.1.4
paloaltonetworks / pan-os12.1.4 – 12.1.4
paloaltonetworks / pan-os12.1.4 – 12.1.4
paloaltonetworks / pan-os12.1.4 – 12.1.4
paloaltonetworks / pan-os12.1.4 – 12.1.4
paloaltonetworks / pan-os12.1.4 – 12.1.4
paloaltonetworks / pan-os12.1.4 – 12.1.4
paloaltonetworks / pan-os12.1.5 – 12.1.5
paloaltonetworks / pan-os12.1.6 – 12.1.6
paloaltonetworks / pan-os12.1.7 – 12.1.7
paloaltonetworks / pan-os12.1.7 – 12.1.7
paloaltonetworks / pan-os12.1.7 – 12.1.7
paloaltonetworks / pan-os12.1.7 – 12.1.7
paloaltonetworks / pan-os12.1.7 – 12.1.7
paloaltonetworks / pan-os12.1.7 – 12.1.7
paloaltonetworks / pan-os12.1.7 – 12.1.7
paloaltonetworks / pan-os12.1.7 – 12.1.7
php / php7.3.0 – 8.2.35
PHP Group / PHP8.4.* – 8.4.27
PHP Group / PHP8.5.* – 8.5.12
PHP Group / PHP8.3.* – 8.3.36
PHP Group / PHP8.2.* – 8.2.35
Siemens / ruggedcom_ape1808_firmware

Exploits & proofs of concept

exploit-dbPHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCEby OffSec
nucleiPHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detectionby lcfr_hax,assetnote,princechaddha

News coverage

PHP2Shell security flaws now sucessfully exploited in the wildBleepingComputer · 15h ago
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted HackingThe Hacker News · 1d ago
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai MalwareThe Hacker News · 4d ago

References

VENDOR_ADVISORYhttps://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

Updated 25m ago · 8 sources