Vulnerability-Lookup

SSA-566435

Vulnerability from csaf_siemens - Published: 2026-10-23 00:00 - Updated: 2026-10-27 00:00

Summary

SSA-566435: PHP2Shell Vulnerabilities in Siemens Software Products

Notes

Summary: On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as "php2shell" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.

General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use: The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

CVE-2026-109618

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CWE-416 - Use After Free

Affected products

Known not affected 31 products

Product	Identifier	Version	Remediation
CADRA Siemens / CADRA		vers:all/*
PADS Pro Student Edition Siemens / PADS Pro Student Edition		vers:all/*
PADS Professional Siemens / PADS Professional		vers:all/*
PADS Professional - XCR Siemens / PADS Professional - XCR		vers:all/*
PADS Standard - XCR Siemens / PADS Standard - XCR		vers:all/*
PADS Standard & Standard Plus Siemens / PADS Standard & Standard Plus		vers:all/*
Polarion Siemens / Polarion		vers:all/*
QuadView Siemens / QuadView		vers:all/*
Simcenter Flomaster Siemens / Simcenter Flomaster		vers:all/*
Simcenter Flux Siemens / Simcenter Flux		vers:all/*
Simcenter Simlab Siemens / Simcenter Simlab		vers:all/*
Capital Siemens / Capital		vers:all/*
Solid Edge Siemens / Solid Edge		vers:all/*
Teamcenter Siemens / Teamcenter		vers:all/*
Teamcenter Product Cost Management Siemens / Teamcenter Product Cost Management		vers:all/*
Teamcenter Visualization Siemens / Teamcenter Visualization		vers:all/*
Tecnomatix Plant Simulation Siemens / Tecnomatix Plant Simulation		vers:all/*
TestWay Siemens / TestWay		vers:all/*
Valor NPI Siemens / Valor NPI		vers:all/*
Xpedition Designer Siemens / Xpedition Designer		vers:all/*
Xpedition Enterprise Siemens / Xpedition Enterprise		vers:all/*
Xpedition Enterprise XCR Siemens / Xpedition Enterprise XCR		vers:all/*
DFMExpress Siemens / DFMExpress		vers:all/*
Xpedition IC Packaging Siemens / Xpedition IC Packaging		vers:all/*
Xpedition Layout Browser Siemens / Xpedition Layout Browser		vers:all/*
HyperLynx Siemens / HyperLynx		vers:all/*
Insights Hub Siemens / Insights Hub		vers:all/*
Opcenter Connect MOM Siemens / Opcenter Connect MOM		vers:all/*
Opcenter Execution Core Siemens / Opcenter Execution Core		vers:all/*
Opcenter X Siemens / Opcenter X		vers:all/*
PADS Pro Essentials Siemens / PADS Pro Essentials		vers:all/*

Threats

Impact PHP is not present in this product

Impact Opcenter Connect MOM does not use PHP in any part of its product architecture

Impact Opcenter Execution Core does not use PHP in any part of its product architecture

Impact Opcenter X does not use PHP, therefore it is not affected by these critical vulnerabilities and no remediations are needed

Impact Polarion suite is not impacted by PHP as there is no usage of PHP. Polarion out of the box components do not use PHP

Impact Simcenter Flomaster is not affected by the PHP issue

Impact Tecnomatic Plant Simulation is not impacted by PHP as there is no usage of PHP

CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CWE-416 - Use After Free

Affected products

Known not affected 31 products, the same list as for CVE-2026-109618

Threats

Impact PHP is not present in this product

Impact Opcenter Connect MOM does not use PHP in any part of its product architecture

Impact Opcenter Execution Core does not use PHP in any part of its product architecture

Impact Opcenter X does not use PHP, therefore it is not affected by these critical vulnerabilities and no remediations are needed

Impact Polarion suite is not impacted by PHP as there is no usage of PHP. Polarion out of the box components do not use PHP

Impact Simcenter Flomaster is not affected by the PHP issue

Impact Tecnomatic Plant Simulation is not impacted by PHP as there is no usage of PHP

References

2 references

URL	Category
https://cert-portal.siemens.com/productcert/html/…	self
https://cert-portal.siemens.com/productcert/csaf/…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as \"php2shell\" (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-566435: PHP2Shell Vulnerabilities in Siemens Software Products - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-566435.html"
      },
      {
        "category": "self",
        "summary": "SSA-566435: PHP2Shell Vulnerabilities in Siemens Software Products - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-566435.json"
      }
    ],
    "title": "SSA-566435: PHP2Shell Vulnerabilities in Siemens Software Products",
    "tracking": {
      "current_release_date": "2026-10-27T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-566435",
      "initial_release_date": "2026-10-23T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-23T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2026-10-26T00:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added Valor NPI, Solid Edge and Capital to \"Known Not Affected Product\" list"
        },
        {
          "date": "2026-10-27T00:00:00.000Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Added Insights Hub, Simcenter Flux and Simcenter Simlab"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "CADRA",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "CADRA"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Capital",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "Capital"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "DFMExpress",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "DFMExpress"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "HyperLynx",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "HyperLynx"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Insights Hub",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "Insights Hub"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Opcenter Connect MOM",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "Opcenter Connect MOM"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Opcenter Execution Core",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "Opcenter Execution Core"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Opcenter X",
                  "product_id": "8"
                }
              }
            ],
            "category": "product_name",
            "name": "Opcenter X"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "PADS Pro Essentials",
                  "product_id": "9"
                }
              }
            ],
            "category": "product_name",
            "name": "PADS Pro Essentials"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "PADS Pro Student Edition",
                  "product_id": "10"
                }
              }
            ],
            "category": "product_name",
            "name": "PADS Pro Student Edition"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "PADS Professional",
                  "product_id": "11"
                }
              }
            ],
            "category": "product_name",
            "name": "PADS Professional"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "PADS Professional - XCR",
                  "product_id": "12"
                }
              }
            ],
            "category": "product_name",
            "name": "PADS Professional - XCR"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "PADS Standard - XCR",
                  "product_id": "13"
                }
              }
            ],
            "category": "product_name",
            "name": "PADS Standard - XCR"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "PADS Standard \u0026 Standard Plus",
                  "product_id": "14"
                }
              }
            ],
            "category": "product_name",
            "name": "PADS Standard \u0026 Standard Plus"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Polarion",
                  "product_id": "15"
                }
              }
            ],
            "category": "product_name",
            "name": "Polarion"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "QuadView",
                  "product_id": "16"
                }
              }
            ],
            "category": "product_name",
            "name": "QuadView"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Simcenter Flomaster",
                  "product_id": "17"
                }
              }
            ],
            "category": "product_name",
            "name": "Simcenter Flomaster"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Simcenter Flux",
                  "product_id": "18"
                }
              }
            ],
            "category": "product_name",
            "name": "Simcenter Flux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Simcenter Simlab",
                  "product_id": "19"
                }
              }
            ],
            "category": "product_name",
            "name": "Simcenter Simlab"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Solid Edge",
                  "product_id": "20"
                }
              }
            ],
            "category": "product_name",
            "name": "Solid Edge"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Teamcenter",
                  "product_id": "21"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Teamcenter Product Cost Management",
                  "product_id": "22"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter Product Cost Management"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Teamcenter Visualization",
                  "product_id": "23"
                }
              }
            ],
            "category": "product_name",
            "name": "Teamcenter Visualization"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Tecnomatix Plant Simulation",
                  "product_id": "24"
                }
              }
            ],
            "category": "product_name",
            "name": "Tecnomatix Plant Simulation"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "TestWay",
                  "product_id": "25"
                }
              }
            ],
            "category": "product_name",
            "name": "TestWay"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Valor NPI",
                  "product_id": "26"
                }
              }
            ],
            "category": "product_name",
            "name": "Valor NPI"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Xpedition Designer",
                  "product_id": "27"
                }
              }
            ],
            "category": "product_name",
            "name": "Xpedition Designer"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Xpedition Enterprise",
                  "product_id": "28"
                }
              }
            ],
            "category": "product_name",
            "name": "Xpedition Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Xpedition Enterprise XCR",
                  "product_id": "29"
                }
              }
            ],
            "category": "product_name",
            "name": "Xpedition Enterprise XCR"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Xpedition IC Packaging",
                  "product_id": "30"
                }
              }
            ],
            "category": "product_name",
            "name": "Xpedition IC Packaging"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Xpedition Layout Browser",
                  "product_id": "31"
                }
              }
            ],
            "category": "product_name",
            "name": "Xpedition Layout Browser"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-109618",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "22",
            "29",
            "16",
            "2",
            "7",
            "25",
            "21",
            "18",
            "5",
            "19",
            "4",
            "8",
            "14",
            "30",
            "11",
            "23",
            "28",
            "1",
            "10",
            "17",
            "3",
            "20",
            "24",
            "15",
            "12",
            "26",
            "6",
            "27",
            "9",
            "13",
            "31"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "1",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "2",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "3",
          "30",
          "31",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9"
        ]
      },
      "threats": [
        {
          "category": "impact",
          "details": "PHP is not present in this product",
          "product_ids": [
            "22",
            "29",
            "16",
            "2",
            "25",
            "21",
            "18",
            "5",
            "19",
            "4",
            "14",
            "30",
            "11",
            "23",
            "28",
            "1",
            "10",
            "20",
            "3",
            "12",
            "26",
            "27",
            "9",
            "13",
            "31"
          ]
        },
        {
          "category": "impact",
          "details": "Opcenter Connect MOM does not use PHP in any part of its product architecture",
          "product_ids": [
            "6"
          ]
        },
        {
          "category": "impact",
          "details": "Opcenter Execution Core does not use PHP in any part of its product architecture",
          "product_ids": [
            "7"
          ]
        },
        {
          "category": "impact",
          "details": "Opcenter X does not use PHP, therefore it is not affected by these critical vulnerabilities and no remediations are needed",
          "product_ids": [
            "8"
          ]
        },
        {
          "category": "impact",
          "details": "Polarion suite is not impacted by PHP as there is no usage of PHP.\r\nPolarion out of the box components do not use PHP",
          "product_ids": [
            "15"
          ]
        },
        {
          "category": "impact",
          "details": "Simcenter Flomaster is not affected by the PHP issue",
          "product_ids": [
            "17"
          ]
        },
        {
          "category": "impact",
          "details": "Tecnomatic Plant Simulation is not impacted by PHP as there is no usage of PHP",
          "product_ids": [
            "24"
          ]
        }
      ],
      "title": "CVE-2026-109618"
    },
    {
      "cve": "CVE-2026-109619",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "22",
            "29",
            "16",
            "2",
            "7",
            "25",
            "21",
            "18",
            "5",
            "19",
            "4",
            "8",
            "14",
            "30",
            "11",
            "23",
            "28",
            "1",
            "10",
            "17",
            "3",
            "20",
            "24",
            "15",
            "12",
            "26",
            "6",
            "27",
            "9",
            "13",
            "31"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "1",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19",
          "2",
          "20",
          "21",
          "22",
          "23",
          "24",
          "25",
          "26",
          "27",
          "28",
          "29",
          "3",
          "30",
          "31",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9"
        ]
      },
      "threats": [
        {
          "category": "impact",
          "details": "PHP is not present in this product",
          "product_ids": [
            "22",
            "29",
            "16",
            "2",
            "25",
            "21",
            "18",
            "5",
            "19",
            "4",
            "14",
            "30",
            "11",
            "23",
            "28",
            "1",
            "10",
            "20",
            "3",
            "12",
            "26",
            "27",
            "9",
            "13",
            "31"
          ]
        },
        {
          "category": "impact",
          "details": "Opcenter Connect MOM does not use PHP in any part of its product architecture",
          "product_ids": [
            "6"
          ]
        },
        {
          "category": "impact",
          "details": "Opcenter Execution Core does not use PHP in any part of its product architecture",
          "product_ids": [
            "7"
          ]
        },
        {
          "category": "impact",
          "details": "Opcenter X does not use PHP, therefore it is not affected by these critical vulnerabilities and no remediations are needed",
          "product_ids": [
            "8"
          ]
        },
        {
          "category": "impact",
          "details": "Polarion suite is not impacted by PHP as there is no usage of PHP.\r\nPolarion out of the box components do not use PHP",
          "product_ids": [
            "15"
          ]
        },
        {
          "category": "impact",
          "details": "Simcenter Flomaster is not affected by the PHP issue",
          "product_ids": [
            "17"
          ]
        },
        {
          "category": "impact",
          "details": "Tecnomatic Plant Simulation is not impacted by PHP as there is no usage of PHP",
          "product_ids": [
            "24"
          ]
        }
      ],
      "title": "CVE-2026-109619"
    }
  ]
}

CVE-2026-109618 (GCVE-0-2026-109618)

Vulnerability from cvelistv5 – Published: 2026-10-21 13:48 – Updated: 2026-10-27 12:58

Title

RCE via OOM corruption

Summary

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 12:15 UTC

CWE

CWE-416 - Use after free
CWE-755 - Improper Handling of Exceptional Conditions
CWE-824 - Access of uninitialized pointer
CWE-1325 - Improperly controlled sequential memory allocation
CWE-1419 - Incorrect Initialization of Resource

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

8 references

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory
https://www.wiz.io/blog/php2shell-php-rce	third-party-advisory
https://arcticwolf.com/resources/blog/php2shell-c…	third-party-advisory
https://php2shell.delftintellab.com	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource
http://www.openwall.com/lists/oss-security/2026/10/21/6
http://www.openwall.com/lists/oss-security/2026/10/23/5
https://cert-portal.siemens.com/productcert/html/…

Impacted products

2 products

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.35 (semver) Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver)
Siemens	RUGGEDCOM APE1808	Affected: 0 , < * (custom)

Credits

Ryan at Calif.io Wiz OpenAI Arnaud Le Blanc Ilija Tovilo Jakub Zelenka Nora Dossche

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109618",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T12:15:42.707817Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-10-26",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T12:58:23.360Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://www.wiz.io/blog/php2shell-php-rce"
          },
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
          },
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://php2shell.delftintellab.com"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-10-26T00:00:00.000Z",
            "value": "CVE-2026-109618 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-23T14:07:55.926Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/6"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/23/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM APE1808",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T13:15:14.291Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-566512.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "php-src",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.35",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.36",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.27",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.12",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ryan at Calif.io"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Wiz"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "OpenAI"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Arnaud Le Blanc"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ilija Tovilo"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Zelenka"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nora Dossche"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\u003cbr\u003e"
            }
          ],
          "value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-234",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-234 Hijacking a privileged process"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use after free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755 Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-824",
              "description": "CWE-824 Access of uninitialized pointer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1325",
              "description": "CWE-1325 Improperly controlled sequential memory allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1419",
              "description": "CWE-1419 Incorrect Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T13:48:34.845Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RCE via OOM corruption",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Check the GitHub Security Advisory for mitigation strategies."
            }
          ],
          "value": "Check the GitHub Security Advisory for mitigation strategies."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-109618",
    "datePublished": "2026-10-21T13:48:34.845Z",
    "dateReserved": "2026-10-12T21:03:58.117Z",
    "dateUpdated": "2026-10-27T12:58:23.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109619 (GCVE-0-2026-109619)

Vulnerability from cvelistv5 – Published: 2026-10-21 13:54 – Updated: 2026-10-27 12:58

Title

RCE via stale global state

Summary

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-27 12:14 UTC

CWE

CWE-416 - Use after free
CWE-755 - Improper Handling of Exceptional Conditions
CWE-824 - Access of uninitialized pointer
CWE-1325 - Improperly controlled sequential memory allocation
CWE-1419 - Incorrect Initialization of Resource

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

17 references

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory
https://www.wiz.io/blog/php2shell-php-rce	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource
https://php2shell.delftintellab.com/	third-party-advisory
https://arcticwolf.com/resources/blog/php2shell-c…	third-party-advisory
http://www.openwall.com/lists/oss-security/2026/10/21/7
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/10/22/2
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/10/23/4
https://cert-portal.siemens.com/productcert/html/…

Impacted products

2 products

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.35 (semver) Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver)
Siemens	RUGGEDCOM APE1808	Affected: 0 , < * (custom)

Credits

Wiz Ryan at Calif.io OpenAI Arnaud Le Blanc Ilija Tovilo Jakub Zelenka Nora Dossche

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109619",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-27T12:14:16.026916Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-10-26",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-27T12:58:23.666Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://www.wiz.io/blog/php2shell-php-rce"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619"
          },
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://php2shell.delftintellab.com/"
          },
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-10-26T00:00:00.000Z",
            "value": "CVE-2026-109619 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-23T14:07:57.152Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/7"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/16"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/17"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/23"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/22/2"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/22/14"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/22/15"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/22/16"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/22/19"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/22/20"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/23/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM APE1808",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T13:15:15.440Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-566512.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "php-src",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.35",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.36",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.27",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.12",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Wiz"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ryan at Calif.io"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "OpenAI"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Arnaud Le Blanc"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ilija Tovilo"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Zelenka"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nora Dossche"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
            }
          ],
          "value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-234",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-234 Hijacking a privileged process"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use after free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755 Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-824",
              "description": "CWE-824 Access of uninitialized pointer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1325",
              "description": "CWE-1325 Improperly controlled sequential memory allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1419",
              "description": "CWE-1419 Incorrect Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T13:54:43.866Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RCE via stale global state",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Check the GitHub Security Advisory for mitigation strategies."
            }
          ],
          "value": "Check the GitHub Security Advisory for mitigation strategies."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-109619",
    "datePublished": "2026-10-21T13:54:43.866Z",
    "dateReserved": "2026-10-12T21:04:00.504Z",
    "dateUpdated": "2026-10-27T12:58:23.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SSA-566435

CVE-2026-109618 (GCVE-0-2026-109618)

CVE-2026-109619 (GCVE-0-2026-109619)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour