Palo Alto Networks Prisma Access and SD-WAN ION affected by PHP out-of-memory remote code execution (CVE-2026-109618)

What happened

PHP uses longjmp() to exit the current context when an out-of-memory error occurs. Some contexts may not account for this correctly and leave request memory uninitialised before a later allocation. During the next request cleanup, PHP can read or branch on that uninitialised memory. Multiple OOM strategies can consistently trigger this, leading to remote code execution.

The CVSS 4.0 vector rates the flaw 9.2: it is reachable over the network, requires no privileges and no user interaction, but has high attack complexity and requires specific conditions to be present. CISA added CVE-2026-109618 to the KEV catalogue on 26 October 2026, with a due date of 29 October 2026, and KEV records it as exploited. Palo Alto Networks has said it is not aware of any malicious exploitation of this issue against its products.

Palo Alto Networks' bulletin also covers a related PHP stale global state flaw, CVE-2026-109619; this page focuses on CVE-2026-109618.

Who is affected

The underlying PHP flaw affects PHP 8.2.* before 8.2.35, 8.3.* before 8.3.36, 8.4.* before 8.4.27, and 8.5.* before 8.5.12. Within Palo Alto Networks' product line, the vendor has published fixed releases for Prisma Access, Prisma Access Agent and Prisma SD-WAN ION. If your deployment runs an earlier build on one of those product branches, treat it as affected and use the fixed versions below.

What to do now

1. Apply the vendor's fixed releases. Prisma Access: 11.2.10-h16 or later. Prisma Access Agent: 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, 11.1.13-h16, or 11.1.16-h4. Prisma SD-WAN ION: 10.2.13-h27, 10.2.16-h12, or 10.2.18-h13. For general PHP deployments, update to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
2. If patching must be phased, apply the vendor's threat coverage. Update Applications and Threats content to 9162, 9163, 9164 or later and enable the Threat Prevention signatures listed in Palo Alto Networks' advisory. Customers with Frontier Virtual Patching on PAN-OS 12.2.4 and later had advance coverage through Threat ID 543004.
3. Meet CISA's KEV due date of 29 October 2026. The KEV entry requires applying mitigations in accordance with the vendor instructions and following CISA's BOD 26-04 guidance on prioritisation and forensics triage.

How to detect it

Detection for Palo Alto Networks deployments is available through the vendor's Threat Prevention signatures; confirm the Applications and Threats content version is current and the relevant threat IDs are active. The vendor advisory does not list host-based indicators of compromise, and the KEV entry does not provide specific IOCs.

Beyond the patch

Because CISA KEV records this as exploited, detection and response are the first line while fixed builds roll out. Our Managed Detection & Response (MDR) and Incident Response Retainer provide that capacity. Because the flaw is reachable over the network without credentials, Virtual CISO Services (vCISO) can review external exposure of affected Prisma Access and SD-WAN ION elements before patching completes.