Skip to main content
Apexward Pulse
Type Vulnerability

Palo Alto Networks

Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

6 sourcesCVE-2026-109618CVE-2026-109619

At a glance

Medium
Suggested 7-day window, counted from the last update
LikelyElevated attack likelihood (~100% in 30 days)
Evidence-weighted, not popularity
Signal

Elevated attack likelihood (~100% in 30 days). Exploitation not confirmed.

Why Medium

Medium rather than High: UK relevance is 40 of 100, little UK-specific signal so far.

Briefing

  • PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request
  • Do not treat uncorroborated claims as confirmed breaches.

Questions to ask IT

  • Do we run PHP and Palo Alto Networks PAN-OS, and which versions?
  • Is any of it reachable from the internet?
  • If it is still not patched, what mitigation is in place, and what is holding the fix up?

Next steps

  1. Confirm whether this affects systems or suppliers in your estate

Summary

  • CVE-2026-109618 has an estimated ~100% chance of attack in 30 days (100th percentile) as of 2026-10-26 — probability signal, not confirmed exploitation

Read the original reportSecurityWeek(opens in a new tab)

Products and services involved

Same event, different frames

Distinct often headline the same incident differently.

Pulse

Last checked 30 Oct · Recheck overdue since 31 Oct 2026, 21:05 UK time

Signal
30 Oct 2026, 21:05 UK time · 30 Oct

Listed on the CISA catalogue.

Listed on the — prioritise confirming exposure and patching.

EscalationDe-escalationCritical / liveWhat these mean
Drag to pan · Ctrl / ⌘ + scroll or pinch to zoom8 events

Sources

How we know

Statements extracted from sources. Higher confidence means stronger corroboration.

  • ClaimedHeadline60% confidence

    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request

  • ProbableSummary fact75% confidence

    Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Google Cloud

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-109618

  • ConfirmedEstimated attack likelihood95% confidence

    CVE-2026-109618 has an estimated ~100% chance of attack in 30 days (100th percentile) as of 2026-10-26 — probability signal, not confirmed exploitation

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-109619

  • ConfirmedEstimated attack likelihood95% confidence

    CVE-2026-109619 has an estimated ~100% chance of attack in 30 days (100th percentile) as of 2026-10-26 — probability signal, not confirmed exploitation