CVE-2026-109618: PHP Out-of-Memory longjmp() Flaw Yields RCE Across PAN-OS and Siemens Energy Platforms

Executive Summary

CVE-2026-109618 is a memory corruption flaw in the PHP runtime where longjmp() unwinding for out-of-memory errors leaves request memory uninitialized, and the subsequent cleanup routine reads or branches on that memory to achieve remote code execution. Scored 9.8 and flagged in the known exploited vulnerability catalog with a public exploit available, this reaches OT-adjacent infrastructure because the vulnerable PHP runtime is embedded in Palo Alto Networks PAN-OS firewalls, Panorama management appliances, and Siemens energy management platforms including Spectrum Power and Energy Engage.

Technical Exposure Breakdown

The defect is in how the PHP engine handles memory exhaustion. PHP uses longjmp() to abort request handling when an allocation fails, jumping back to a recovery point and discarding the current execution context. Some code paths do not fully initialize their allocated structures before the OOM condition fires. When the request teardown procedure then runs, it reads or branches on memory that was never set to a defined state. An attacker who can reliably drive the process into an out-of-memory condition can shape heap contents so the cleanup logic dereferences or jumps on attacker-influenced data, resulting in code execution in the context of the PHP process.

The grounding data lists the vulnerable PHP ranges as 7.3.0 through 8.2.35, 8.3.0 through 8.3.36, 8.4.0 through 8.4.27, and 8.5.0 through 8.5.12. The practical OT concern is not generic web hosting. It is that PHP ships inside the administrative and web interfaces of products that sit at the edge of control networks. The grounding data identifies PAN-OS ranges 10.2.0 through 10.2.7, 11.1.0 through 11.1.4, 11.2.0 through 11.2.4, 12.1.0 through 12.1.4, and 12.2.0 through 12.2.4, along with Panorama M-200 through M-700 hardware, the Panorama virtual appliance, and WF-500 and WF-500-B appliances. On the Siemens side the data lists Spectrum Power 4, Spectrum Power 7, Spectrum Power TG, Energy Engage, AMIS TS, the BluePlanet 360 NX3 product family, and RUGGEDCOM APE1808 firmware. These are the assets that terminate remote access and host energy management and distribution automation functions.

OT Impact and Compliance Risk

A compromised PAN-OS firewall or Panorama instance is not a perimeter inconvenience. It is the enforcement boundary between corporate IT and the control environment. Code execution on that device gives an attacker the ability to rewrite policy, inspect and manipulate traffic crossing the IT/OT demarcation, and pivot inward. A compromised Spectrum Power or Energy Engage node is more direct because these platforms participate in grid state estimation, SCADA front-end processing, and operational decision support. Loss of integrity here can translate into falsified telemetry presented to operators or manipulated control actions.

For NERC CIP registered entities, firewalls and energy management systems in these ranges are Electronic Security Perimeter and BES Cyber System components, and exploitation drives CIP-005 and CIP-007 obligations. Under IEC 62443 this is a zone boundary and conduit compromise that collapses the segmentation model the asset owner is required to maintain. Pipeline operators under TSA SD-02C and water utilities under AWIA 2018 face the same structural problem where the device enforcing network segmentation is itself the target.

Compensating Controls

Do not run active vulnerability scans or aggressive version probes against Siemens energy management nodes or RUGGEDCOM devices to confirm exposure. Active scanning can brick industrial components and disrupt the very processes you are trying to protect. Validate affected versions against vendor inventory records and passive asset data instead.

Restrict reachability of the administrative and web management interfaces on PAN-OS, Panorama, WF-500, and the Siemens platforms to a dedicated management network with no path from untrusted segments. The exploit requires the attacker to reach the PHP-backed interface, so removing that reachability removes the attack surface regardless of patch availability, which is listed as unknown in the grounding data.

Deploy a virtual patch at the network layer. A Suricata rule concept here monitors HTTP request bodies and parameter sets directed at the management interfaces for patterns consistent with forced memory exhaustion, such as abnormally large or deeply nested POST payloads and request floods crafted to trigger allocation failure. Rate limit and size-cap requests to these interfaces at an inline sensor, and alert on repeated OOM-triggering request shapes. Pair this with session controls that require VPN and multifactor authentication before any management plane is reachable.

BreachSpider Intel

BreachSpider tracks exploitation signals and affected product movement for CVE-2026-109618 across PAN-OS and Siemens energy platforms so OT teams can prioritize segmentation and virtual patching ahead of confirmed in-the-wild activity.