PHP memory flaw allows remote code execution; exploited in the wild

What happened

A critical weakness has been found in PHP, the scripting language maintained by the PHP Group. When PHP runs out of memory during a request, it jumps out of the current processing context to abort the request. Some parts of the code do not handle this abrupt exit correctly. They can leave request memory uninitialized before an allocation takes place, and the cleanup routine that runs afterward may then act on that uninitialized data.

According to the description, several ways of exhausting memory can reliably trigger this state. The result can be remote code execution on the affected server.

The flaw was published on 2026-10-21. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-26, which means it is being exploited in the wild.

Who is affected

The data available to us lists the following PHP versions as affected: 7.3.0 up to but not including 8.2.35, 8.3.0 up to but not including 8.3.36, 8.4.0 up to but not including 8.4.27, and 8.5.0 up to but not including 8.5.12.

Products that include PHP are also listed. These include Palo Alto Networks PAN-OS and Panorama virtual appliance, and Siemens Energy Engage, Spectrum Power 4 and Spectrum Power 7, along with other software that bundles PHP.

Cisco has published advisory cisco-sa-php-october26-Jj384Daq about PHP flaws affecting its products. Fortinet has published advisory FG-IR-26-186. Neither advisory confirms a fix in the data available to us.

How serious is it

The PHP project rates the flaw 9.2 out of 10 under CVSS version 4.0, which places it in the critical range. An attacker does not need to log in or have a user take any action. However, the scoring notes that successful exploitation depends on conditions that raise its complexity.

CISA lists the flaw as actively exploited and set a remediation due date of 2026-10-29 for US federal agencies. The EPSS score, an estimate of how likely a flaw is to be exploited, is 0.99999. The weakness classes listed include CWE-416 (use after free) and CWE-824 (access of uninitialized pointer).

What you should do

1. 1Upgrade PHP to a release outside the affected version ranges listed above, following the PHP Group's guidance.
2. 2Check whether products from Palo Alto Networks, Siemens, Cisco or Fortinet in your environment bundle an affected PHP version.
3. 3Follow Cisco advisory cisco-sa-php-october26-Jj384Daq and Fortinet advisory FG-IR-26-186 for guidance on those vendors' products.
4. 4Apply the vendor mitigations where updates are not yet available, as CISA directs, or stop using the product if no mitigations exist.
5. 5Review internet-facing PHP servers for signs of compromise, given the confirmed exploitation.

Quick facts