CVE-2026-109618

Vulnerability overview

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Severity and scoring

CVSS score

9.2 · CRITICAL

CVSS version

4.0

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-1325, CWE-416, CWE-755, CWE-824

CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.

Known exploitation and remediation

Listed in CISA’s Known Exploited Vulnerabilities catalog.

Affected product

PHP Group · PHP

Added to catalog

2026-10-26

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA remediation due date

2026-10-29

CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.

Verify affected versions and patch availability in the vendor advisory before making changes.

Affected products and versions

• cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

  From (inclusive): 7.3.0

  Before (exclusive): 8.2.35

• cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

  From (inclusive): 8.3.0

  Before (exclusive): 8.3.36

• cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

  From (inclusive): 8.4.0

  Before (exclusive): 8.4.27

• cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

  From (inclusive): 8.5.0

  Before (exclusive): 8.5.12

• cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

  From (inclusive): 10.2.0

  Before (exclusive): 10.2.7

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h11:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h13:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h14:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h15:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h17:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h20:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h22:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h23:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h24:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h32:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h34:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h35:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h36:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h37:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h38:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h4:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h5:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h7:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h9:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:*:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:*:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h13:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h14:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h17:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h18:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h21:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h27:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h30:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h31:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h36:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h37:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h39:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h40:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h41:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h6:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h8:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h9:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.11:*:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:*:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h15:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h16:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h18:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h21:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h22:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h23:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h24:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h26:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h3:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h4:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h5:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h7:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.14:*:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.15:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h11:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h4:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h6:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h7:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h8:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h9:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.17:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h12:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h5:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h6:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h7:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h8:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h9:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

  From (inclusive): 11.1.0

  Before (exclusive): 11.1.4

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h11:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h12:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h13:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h15:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h16:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h17:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h18:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h25:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h27:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h3:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h32:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h33:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h34:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h35:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h36:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h37:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h4:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h5:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h6:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h7:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h8:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h9:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:*:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h14:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h17:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h18:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h19:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h20:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h21:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h22:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h23:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h25:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h29:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h3:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h32:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h33:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h34:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h35:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h36:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h38:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h39:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h4:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h5:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h6:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h7:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h11:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h4:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h6:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.7:h8:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.8:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.9:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h12:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h21:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h25:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h26:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h27:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h28:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h30:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h32:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h33:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h35:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h4:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h5:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h7:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h9:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.11:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.12:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h11:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h12:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h15:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h3:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h5:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h6:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h7:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h8:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h9:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.14:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.15:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.16:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.16:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.16:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.1.16:h3:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

  From (inclusive): 11.2.0

  Before (exclusive): 11.2.4

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h11:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h12:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h14:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h15:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h17:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h18:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h20:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h3:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h4:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h5:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h6:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h7:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h8:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h9:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.5:*:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.6:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h11:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h12:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h13:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h14:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h15:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h16:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h17:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h18:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h19:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h3:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h4:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h7:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h8:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.8:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.9:*:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h12:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h13:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h3:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h4:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h5:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h6:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h7:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h8:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h9:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.11:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.12:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.13:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.13:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.13:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.13:h3:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.15:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:11.2.16:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

  From (inclusive): 12.1.0

  Before (exclusive): 12.1.4

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h10:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h11:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h12:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h3:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h5:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h6:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h7:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h8:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h9:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.5:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.6:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h1:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h3:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h5:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h6:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h8:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h9:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.8:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.9:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.10:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:12.1.10:h2:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

  From (inclusive): 12.2.0

  Before (exclusive): 12.2.4

• cpe:2.3:o:paloaltonetworks:pan-os:12.2.4:-:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:-:*:*:*:*:*:*:*

• cpe:2.3:a:paloaltonetworks:panorama_virtual_appliance:-:*:*:*:*:*:*:*

• cpe:2.3:o:paloaltonetworks:pan-os:-:*:*:*:*:*:*:*

These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.

Advisories and references

• https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

  Mitigation · Vendor Advisory

• http://www.openwall.com/lists/oss-security/2026/10/21/6

  Mailing List · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2026/10/23/5

  Mailing List · Third Party Advisory

• https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/

  Third Party Advisory

• https://cert-portal.siemens.com/productcert/html/ssa-566512.html

  Third Party Advisory

• https://php2shell.delftintellab.com

  Third Party Advisory

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618

  US Government Resource

• https://www.wiz.io/blog/php2shell-php-rce

  Third Party Advisory

Explore official sources

Read the official NVD record ↗

Explore the CISA catalog ↗

Back to CVE intelligence