Vulnerability-Lookup

SSA-166980

Vulnerability from csaf_siemens - Published: 2026-10-26 00:00 - Updated: 2026-10-27 00:00

Summary

SSA-166980: PHP2Shell Vulnerabilities in Siemens Products

Notes

Summary: On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products. As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines, and to follow the recommendations in the product manuals. Siemens is actively monitoring the situation and assessing the implications of these vulnerabilities on our portfolio. Because this evaluation is ongoing, our findings are subject to change as new technical details and vendor updates emerge. We will publish updated findings, guidance, and remediation recommendations as soon as they become available.

General Recommendations: Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment. Recommended security guidelines can be found at: https://www.siemens.com/gridsecurity

Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use: The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

CVE-2026-109618

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CWE-416 - Use After Free

Affected products

Known not affected 20 products

Product	Identifier	Version	Remediation
Building X Siemens / Building X		vers:all/*
Desigo PXC4 Siemens / Desigo PXC4		vers:all/*
Desigo PXC5 Siemens / Desigo PXC5		vers:all/*
Desigo PXC7 Siemens / Desigo PXC7		vers:all/*
Navigator E&S Siemens / Navigator E&S		vers:all/*
Sinteso FS20 EN Siemens / Sinteso FS20 EN		vers:all/*
SiPass integrated Siemens / SiPass integrated		vers:all/*
SIPORT Siemens / SIPORT		vers:all/*
Siveillance Control Siemens / Siveillance Control		vers:all/*
Siveillance Control Pro Siemens / Siveillance Control Pro		vers:all/*
Siveillance Intrusion Siemens / Siveillance Intrusion		vers:all/*
Climatix Cloud IC Siemens / Climatix Cloud IC		vers:all/*
Siveillance Video Siemens / Siveillance Video		vers:all/*
Climatix Devices Siemens / Climatix Devices		vers:all/*
Connect X200 Siemens / Connect X200		vers:all/*
Connect X300 Siemens / Connect X300		vers:all/*
Connect X500 Siemens / Connect X500		vers:all/*
cRSP Siemens / cRSP		vers:all/*
Desigo CC Siemens / Desigo CC		vers:all/*
Desigo Optic Siemens / Desigo Optic		vers:all/*

Threats

Impact PHP is not present in this product

CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CWE-416 - Use After Free

Affected products

Known not affected 20 products, the same list as for CVE-2026-109618

Threats

Impact PHP is not present in this product

References

2 references

URL	Category
https://cert-portal.siemens.com/productcert/html/…	self
https://cert-portal.siemens.com/productcert/csaf/…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as \"php2shell\" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines, and to follow the recommendations in the product manuals.\n\nSiemens is actively monitoring the situation and assessing the implications of these vulnerabilities on our portfolio. Because this evaluation is ongoing, our findings are subject to change as new technical details and vendor updates emerge. We will publish updated findings, guidance, and remediation recommendations as soon as they become available.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. \nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\nhttps://www.siemens.com/gridsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-166980: PHP2Shell Vulnerabilities in Siemens Products - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-166980.html"
      },
      {
        "category": "self",
        "summary": "SSA-166980: PHP2Shell Vulnerabilities in Siemens Products - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-166980.json"
      }
    ],
    "title": "SSA-166980: PHP2Shell Vulnerabilities in Siemens Products",
    "tracking": {
      "current_release_date": "2026-10-27T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-166980",
      "initial_release_date": "2026-10-26T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-26T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2026-10-27T00:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Updated the Known not affected list"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Building X",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Building X"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Climatix Cloud IC",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "Climatix Cloud IC"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Climatix Devices",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "Climatix Devices"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Connect X200",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "Connect X200"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Connect X300",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "Connect X300"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Connect X500",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "Connect X500"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "cRSP",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "cRSP"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Desigo CC",
                  "product_id": "8"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo CC"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Desigo Optic",
                  "product_id": "9"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo Optic"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Desigo PXC4",
                  "product_id": "10"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC4"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Desigo PXC5",
                  "product_id": "11"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC5"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Desigo PXC7",
                  "product_id": "12"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo PXC7"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Navigator E\u0026S",
                  "product_id": "13"
                }
              }
            ],
            "category": "product_name",
            "name": "Navigator E\u0026S"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Sinteso FS20 EN",
                  "product_id": "14"
                }
              }
            ],
            "category": "product_name",
            "name": "Sinteso FS20 EN"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SiPass integrated",
                  "product_id": "15"
                }
              }
            ],
            "category": "product_name",
            "name": "SiPass integrated"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIPORT",
                  "product_id": "16"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPORT"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Siveillance Control",
                  "product_id": "17"
                }
              }
            ],
            "category": "product_name",
            "name": "Siveillance Control"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Siveillance Control Pro",
                  "product_id": "18"
                }
              }
            ],
            "category": "product_name",
            "name": "Siveillance Control Pro"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Siveillance Intrusion",
                  "product_id": "19"
                }
              }
            ],
            "category": "product_name",
            "name": "Siveillance Intrusion"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Siveillance Video",
                  "product_id": "20"
                }
              }
            ],
            "category": "product_name",
            "name": "Siveillance Video"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-109618",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "16",
            "2",
            "7",
            "18",
            "5",
            "19",
            "4",
            "8",
            "14",
            "11",
            "1",
            "10",
            "17",
            "3",
            "20",
            "15",
            "12",
            "6",
            "9",
            "13"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "1",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "2",
          "20",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9"
        ]
      },
      "threats": [
        {
          "category": "impact",
          "details": "PHP is not present in this product",
          "product_ids": [
            "16",
            "2",
            "7",
            "18",
            "5",
            "19",
            "4",
            "8",
            "14",
            "11",
            "1",
            "10",
            "17",
            "3",
            "20",
            "15",
            "12",
            "6",
            "9",
            "13"
          ]
        }
      ],
      "title": "CVE-2026-109618"
    },
    {
      "cve": "CVE-2026-109619",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "16",
            "2",
            "7",
            "18",
            "5",
            "19",
            "4",
            "8",
            "14",
            "11",
            "1",
            "10",
            "17",
            "3",
            "20",
            "15",
            "12",
            "6",
            "9",
            "13"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "1",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "2",
          "20",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9"
        ]
      },
      "threats": [
        {
          "category": "impact",
          "details": "PHP is not present in this product",
          "product_ids": [
            "16",
            "2",
            "7",
            "18",
            "5",
            "19",
            "4",
            "8",
            "14",
            "11",
            "1",
            "10",
            "17",
            "3",
            "20",
            "15",
            "12",
            "6",
            "9",
            "13"
          ]
        }
      ],
      "title": "CVE-2026-109619"
    }
  ]
}

CVE-2026-109618 (GCVE-0-2026-109618)

Vulnerability from cvelistv5 – Published: 2026-10-21 13:48 – Updated: 2026-10-27 12:58

Title

RCE via OOM corruption

Summary

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 12:15 UTC

CWE

CWE-416 - Use after free
CWE-755 - Improper Handling of Exceptional Conditions
CWE-824 - Access of uninitialized pointer
CWE-1325 - Improperly controlled sequential memory allocation
CWE-1419 - Incorrect Initialization of Resource

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

8 references

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory
https://www.wiz.io/blog/php2shell-php-rce	third-party-advisory
https://arcticwolf.com/resources/blog/php2shell-c…	third-party-advisory
https://php2shell.delftintellab.com	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource
http://www.openwall.com/lists/oss-security/2026/10/21/6
http://www.openwall.com/lists/oss-security/2026/10/23/5
https://cert-portal.siemens.com/productcert/html/…

Impacted products

2 products

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.35 (semver) Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver)
Siemens	RUGGEDCOM APE1808	Affected: 0 , < * (custom)

Credits

Ryan at Calif.io Wiz OpenAI Arnaud Le Blanc Ilija Tovilo Jakub Zelenka Nora Dossche

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109618",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T12:15:42.707817Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-10-26",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T12:58:23.360Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://www.wiz.io/blog/php2shell-php-rce"
          },
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
          },
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://php2shell.delftintellab.com"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-10-26T00:00:00.000Z",
            "value": "CVE-2026-109618 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-23T14:07:55.926Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/6"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/23/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM APE1808",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T13:15:14.291Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-566512.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "php-src",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.35",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.36",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.27",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.12",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ryan at Calif.io"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Wiz"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "OpenAI"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Arnaud Le Blanc"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ilija Tovilo"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Zelenka"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nora Dossche"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\u003cbr\u003e"
            }
          ],
          "value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-234",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-234 Hijacking a privileged process"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use after free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755 Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-824",
              "description": "CWE-824 Access of uninitialized pointer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1325",
              "description": "CWE-1325 Improperly controlled sequential memory allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1419",
              "description": "CWE-1419 Incorrect Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T13:48:34.845Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RCE via OOM corruption",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Check the GitHub Security Advisory for mitigation strategies."
            }
          ],
          "value": "Check the GitHub Security Advisory for mitigation strategies."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-109618",
    "datePublished": "2026-10-21T13:48:34.845Z",
    "dateReserved": "2026-10-12T21:03:58.117Z",
    "dateUpdated": "2026-10-27T12:58:23.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109619 (GCVE-0-2026-109619)

Vulnerability from cvelistv5 – Published: 2026-10-21 13:54 – Updated: 2026-10-27 12:58

Title

RCE via stale global state

Summary

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 12:14 UTC

CWE

CWE-416 - Use after free
CWE-755 - Improper Handling of Exceptional Conditions
CWE-824 - Access of uninitialized pointer
CWE-1325 - Improperly controlled sequential memory allocation
CWE-1419 - Incorrect Initialization of Resource

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

17 references

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory
https://www.wiz.io/blog/php2shell-php-rce	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource
https://php2shell.delftintellab.com/	third-party-advisory
https://arcticwolf.com/resources/blog/php2shell-c…	third-party-advisory
http://www.openwall.com/lists/oss-security/2026/10/21/7
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/10/22/2
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/10/23/4
https://cert-portal.siemens.com/productcert/html/…

Impacted products

2 products

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.35 (semver) Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver)
Siemens	RUGGEDCOM APE1808	Affected: 0 , < * (custom)

Credits

Wiz Ryan at Calif.io OpenAI Arnaud Le Blanc Ilija Tovilo Jakub Zelenka Nora Dossche

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109619",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T12:14:16.026916Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-10-26",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T12:58:23.666Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://www.wiz.io/blog/php2shell-php-rce"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619"
          },
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://php2shell.delftintellab.com/"
          },
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-10-26T00:00:00.000Z",
            "value": "CVE-2026-109619 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-23T14:07:57.152Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/7"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/16"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/17"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/23"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/22/2"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/22/14"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/22/15"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/22/16"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/22/19"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/22/20"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/23/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM APE1808",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T13:15:15.440Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-566512.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "php-src",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.35",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.36",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.27",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.12",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Wiz"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ryan at Calif.io"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "OpenAI"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Arnaud Le Blanc"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ilija Tovilo"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Zelenka"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nora Dossche"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
            }
          ],
          "value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-234",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-234 Hijacking a privileged process"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use after free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755 Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-824",
              "description": "CWE-824 Access of uninitialized pointer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1325",
              "description": "CWE-1325 Improperly controlled sequential memory allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1419",
              "description": "CWE-1419 Incorrect Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T13:54:43.866Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RCE via stale global state",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Check the GitHub Security Advisory for mitigation strategies."
            }
          ],
          "value": "Check the GitHub Security Advisory for mitigation strategies."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-109619",
    "datePublished": "2026-10-21T13:54:43.866Z",
    "dateReserved": "2026-10-12T21:04:00.504Z",
    "dateUpdated": "2026-10-27T12:58:23.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SSA-166980

CVE-2026-109618 (GCVE-0-2026-109618)

CVE-2026-109619 (GCVE-0-2026-109619)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour