PHP Memory Corruption Vulnerability
PHP Group — PHP
- Added to KEV catalog
- 26 October 2026
- Federal remediation due date
- 29 October 2026
- Weakness classification (CWE)
- CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
AI Breakdown
What it is
PHP contains a memory corruption vulnerability caused by an out-of-memory condition. This flaw allows unauthenticated remote attackers to execute arbitrary code on vulnerable systems without needing valid credentials.
Why it matters
This vulnerability is listed by CISA as actively exploited in the wild, meaning threat actors are actively taking advantage of it to compromise servers. While known use in ransomware campaigns is currently unknown, unauthenticated remote code execution represents a severe risk of complete system takeover.
Recommended action
Apply vendor mitigations and security updates immediately, prioritizing internet-exposed assets in accordance with CISA BOD 26-04 guidance and forensics triage requirements. For cloud services where mitigations cannot be applied, follow relevant guidance or discontinue use of the affected PHP product. Ensure all necessary remediation steps are completed by the federal due date of October 29, 2026.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109618
More PHP Group Vulnerabilities
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services