CVE-2026-109619
CVE-2026-109619 is covered by the cisco-sa-php-october26-Jj384Daq security bulletin. Not in the CISA KEV catalog. Critical advisory severity.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-109619 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Critical
- VulniPulse record
- Published · Updated
Is CVE-2026-109619 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-109619 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-109619?
This CVE is tracked through a multi-CVE bulletin, so its fixed releases may differ from the bulletin-wide values below. Check the vendor source.
Vendor advisory comparison
Cisco
1 advisory- Advisory severityCritical
Critical [CVE-2026-109618 +1] Vulnerabilities in PHP Affecting Cisco Products: October 2026
cisco-sa-php-october26-Jj384DaqSource published
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: - CVE-2026-109618 - RCE via OOM corruption - CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. These vulnerabilities are being referenced as PHP2shell.
- Related products — impact not confirmed
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
- Workarounds
- There are no workarounds that address these vulnerabilities.
Fortinet
1 advisory- Advisory severityCritical9.8
Critical [CVE-2026-109618 +1] PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
FG-IR-26-186Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
CVSSv3 Score: 9.8 CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Revised on 2026-10-21 00:00:00
- Related products — impact not confirmed
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
NetApp
1 advisory- Advisory severityCritical9.2
Critical [CVE-2026-109618 +1] October 2026 PHP Vulnerabilities in NetApp Products
NTAP-20261021-0021Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
PHP versions 8.2.x prior to 8.2.35, 8.3.x prior to 8.3.36, 8.4.x prior to 8.4.27 and 8.5.x prior to 8.5.12 are susceptible to vulnerabilities referred to as php2shell which when successfully exploited could lead to unauthenticated remote code execution. Successful exploitation of these vulnerabilities could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- 8.2.35
- 8.3.36
- 8.4.27
- 8.5.12
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
NetScaler
1 advisory- Advisory severityUnrated
Advisory [CVE-2026-109618 +1] Protecting NetScaler Management Access from PHP CVE-2026-109618 & CVE 2026-109619
CTX228148Source published
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Immediate mitigation guidance for NetScaler customers By NetScaler Product Security NetScaler is impacted by two PHP memory safety vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because the NetScaler Management Portal uses PHP. Citrix is actively working to upgrade the PHP software package to a fixed version. We will update this post when the fix becomes available. As recommended in NetScaler’s Secure Deployment Guide, management interfaces must be logically or physically isolated from data traffic, completely blocked from the Internet, and restricted via ACLs to trusted administrative subnets only. Customers should immediately restrict access to NetScaler management interfaces to trusted, limited networks. This step reduces exposure by ensuring that only authorized administrative…
- Related products — impact not confirmed
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Citrix is actively working to upgrade the PHP software package to a fixed version.
- We will update this post when the fix becomes available.
- Wherever possible, keep management interfaces on isolated networks that are not Internet-facing and use jump hosts or tightly scoped ACLs to limit administrative access.
- Apply equivalent restrictions to every management-enabled IP, including the Cluster IP in cluster deployments.
- Workarounds
- Customers should immediately restrict access to NetScaler management interfaces to trusted, limited networks.
- Recommended immediate mitigation Restrict GUI & API access on the NSIP, management-enabled SNIPs and the Cluster IP to trusted administrative hosts or narrowly scoped management networks.
- For detailed guidance, see How to Restrict NetScaler Management Interfaces with ACLs (CTX228148).
Palo Alto
1 advisory- Advisory severityCritical9.2
Critical [CVE-2026-109618 +1] Impact of Critical Vulnerabilities in PHP (, CVE-2026-109619) on Palo Alto Networks Products
CVE-2026-109618Source published
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (, CVE-2026-109619) on Palo Alto Networks Products
- Affected products in this advisory
- PAN-OS
- Panorama
- Source-reported affected versions
- PAN-OS All
- Panorama All
- Source-reported fixed versions
- PAN-OS: None
- Panorama: None
- Mitigation guidance
- This issue will be fixed in the upcoming releases of PAN-OS.
- This advisory will be updated with fixed versions and release estimates as they become available.
- Workarounds
- Customers with Frontier Virtual Patching received advance coverage, released via Threat ID 543004, which was released at 10:21 PM PT on Oct 20.
- After publication of the vulnerability and patches, Advanced Threat Prevention (ATP) has also released standard IPS coverage (via signatures 543004, 97622, 97623, 97624, 97625), released Oct 21st.
- The security risk posed by this issue on PAN-OS is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.