Fortinet investigates CVE-2026-109618, a PHP out-of-memory flaw enabling RCE, across its product portfolio
Fortinet published PSIRT advisory FG-IR-26-186 for CVE-2026-109618, a flaw in PHP that can lead to remote code execution (RCE). PHP uses longjmp() to abort request handling on out-of-memory (OOM) errors. Some contexts do not account for this and leave request memory uninitialized before an allocation. Fortinet says it is still investigating the impact on its products and lists a broad set of potentially affected products, but it has not confirmed any of them as vulnerable. The advisory does not mention exploitation in the wild, patches or fixed versions.
Entenda a falha
A vulnerabilidade
CVE-2026-109618 is a flaw in PHP's handling of out-of-memory (OOM) errors that, according to Fortinet's advisory FG-IR-26-186, can lead to remote code execution. The advisory does not say what an attacker needs (network reach, authentication, configuration), and it gives no affected or fixed PHP versions. Fortinet is still investigating and lists a broad set of products (FortiADC, FortiClient EMS, FortiSIEM, FortiOS, FortiManager, FortiWeb, FortiMail, FortiNAC and others) without confirming any as vulnerable. No patches or workarounds are published.
Como funciona
When PHP runs out of memory while handling a request, it uses longjmp() to leave the current context and abort that request. In some contexts this jump happens at a point where request memory has not yet been initialized before an allocation. The request cleanup procedure then runs and may read or branch on that uninitialized memory. That is the step where things go wrong. The advisory says several OOM strategies can trigger this condition consistently and lead to RCE.
Por que é vulnerável
The root cause is mishandling of OOM conditions: the longjmp()-based abort is not accounted for in some contexts, so request memory is left uninitialized before an allocation and the later cleanup trusts it. The articles do not explain why it went unnoticed, and no fix is described yet.
Como foi descoberta
The articles do not say who found the flaw or how it was reported. It became public through Fortinet's PSIRT advisory FG-IR-26-186, published on 2026-10-21, which points to the NVD entry. The advisory does not mention exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 21/10/2026 18:18.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.
Detalhes técnicos
- The root cause is mishandling of OOM conditions in PHP.
longjmp()exits the current context, and request memory is left uninitialized before an allocation. - The subsequent request cleanup procedure may read or branch on this uninitialized memory.
- According to the advisory, multiple OOM strategies can consistently trigger the condition and lead to RCE.
- Products listed for impact assessment: FortiADC, FortiADC Manager, FortiClient EMS, FortiDDoS, FortiDDoS-F, FortiSIEM, FortiMonitor, FortiClient Cloud, FortiSOAR, FortiSOAR PaaS, FortiGuard, FortiEndpoint, FortiOS, FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiClient Linux/Windows/MacOS, FortiSASE, FortiAuthenticator, FortiSwitch and FortiNAC.
Remediação
- No fixed versions or workarounds are given in the advisory. Monitor FG-IR-26-186 and the NVD entry for Fortinet's impact determination and patches.
- Inventory the listed Fortinet products and prioritize management interfaces and internet-exposed instances once patches become available.
Linha do tempo
-
Fortinet investigates CVE-2026-109618, a PHP out-of-memory flaw enabling RCE, across its product portfolio
ler a análise desta fonte ocultar
Fortinet published PSIRT advisory FG-IR-26-186 for CVE-2026-109618, a flaw in PHP that can lead to remote code execution (RCE). PHP uses
longjmp()to abort request handling on out-of-memory (OOM) errors. Some contexts do not account for this and leave request memory uninitialized before an allocation. Fortinet says it is still investigating the impact on its products and lists a broad set of potentially affected products, but it has not confirmed any of them as vulnerable. The advisory does not mention exploitation in the wild, patches or fixed versions.Technical Details
- The root cause is mishandling of OOM conditions in PHP.
longjmp()exits the current context, and request memory is left uninitialized before an allocation. - The subsequent request cleanup procedure may read or branch on this uninitialized memory.
- According to the advisory, multiple OOM strategies can consistently trigger the condition and lead to RCE.
- Products listed for impact assessment: FortiADC, FortiADC Manager, FortiClient EMS, FortiDDoS, FortiDDoS-F, FortiSIEM, FortiMonitor, FortiClient Cloud, FortiSOAR, FortiSOAR PaaS, FortiGuard, FortiEndpoint, FortiOS, FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiClient Linux/Windows/MacOS, FortiSASE, FortiAuthenticator, FortiSwitch and FortiNAC.
Remediation
- No fixed versions or workarounds are given in the advisory. Monitor FG-IR-26-186 and the NVD entry for Fortinet's impact determination and patches.
- Inventory the listed Fortinet products and prioritize management interfaces and internet-exposed instances once patches become available.
- The root cause is mishandling of OOM conditions in PHP.