CVE-2026-109619: PHP Request Memory Reuse Flaw Reaches Deep Into OT Management Infrastructure

Executive Summary

CVE-2026-109619 is a use-after-free condition in PHP where global state continues to reference request memory after that memory has been freed, allowing subsequent requests to read or branch on stale pointers and reach remote code execution. The flaw is embedded in the PHP runtime that underpins management and HMI web interfaces across PAN-OS firewalls, Panorama appliances, and multiple Siemens energy management platforms, which means an attacker gaining code execution on the management plane can pivot toward the equipment that enforces network segmentation and monitors the grid.

Technical Exposure Breakdown

The root cause is improper reset of PHP global state across request boundaries. PHP maintains various global structures that temporarily point into per-request memory arenas. When those structures are not correctly reset at request teardown, or are repopulated after being reset, the global state keeps a dangling reference into memory that has already been freed and potentially reallocated. A later request that reads or conditionally branches on that uninitialized or stale state operates on attacker-influenceable memory. Multiple independent trigger strategies produce the condition, which raises the probability of reliable exploitation and lowers the bar for weaponization.

Per the grounding data, the vulnerable PHP ranges span 5.4.0-8.2.35, 8.3.0-8.3.36, 8.4.0-8.4.27, and 8.5.0-8.5.12. The ubiquity of these versions matters for OT because PHP is not an application you choose to run on a plant network. It ships embedded inside vendor appliance firmware. The grounding data lists affected Palo Alto Networks PAN-OS ranges including 10.2.0-10.2.7, 11.1.0-11.1.4, 11.2.0-11.2.4, 12.1.0-12.1.4, and 12.2.0-12.2.4, along with Panorama M-200 through M-700, the Panorama virtual appliance, and WF-500 and WF-500-B. On the Siemens side the data names AMIS TS, Energy Engage, Spectrum Power 3, 4, 7, and TG, the BluePlanet 360 NX3 firmware variants, and the RUGGEDCOM APE1808 firmware. These are not peripheral assets. They are firewalls, SCADA and energy management systems, and metering infrastructure.

The CVSS score is 8.1 and the vulnerability is flagged in the known exploited vulnerability catalog. Patch status in the grounding data is unknown, so treat this as an actively exploited flaw with no confirmed fix in hand.

OT Impact and Compliance Risk

The attack vector is the web management interface, which is exactly the surface that OT teams are told to isolate but frequently leave reachable from an engineering VLAN or a jump host. On PAN-OS and Panorama, management plane RCE means an adversary can alter security policy, disable logging, and remove the segmentation boundary between the enterprise network and the control network. On Spectrum Power and Energy Engage, code execution reaches the systems that model and command grid state, which translates into direct physical consequence for a utility.

For electric utilities, compromise of these systems implicates NERC CIP, specifically CIP-005 electronic security perimeters and CIP-007 systems security management, because the vulnerable devices are the perimeter and the monitored cyber assets. IEC 62443-3-3 system requirements for zone and conduit integrity are undermined when the firewall itself is the target. Water utilities running similar PHP-backed management stacks should map this against AWIA 2018 risk and resilience obligations. Pipeline operators under TSA SD-02C must account for a flaw that defeats the segmentation and access control measures the directive mandates.

Compensating Controls

Do not rely on a patch arriving on your maintenance window. Remove all management interface exposure from any network segment that does not strictly require it, and force management traffic through a dedicated out-of-band network with strong authentication. Where the vendor permits, restrict the management web service to an explicit allowlist of administrative source addresses.

For virtual patching, deploy an inline IPS in front of the management interface rather than attempting active scanning of the appliances themselves. Active probing of energy management systems and metering equipment can crash or brick fragile embedded web stacks, so limit detection to passive inspection and traffic that is already permitted. A Suricata rule concept here anchors on anomalous PHP request patterns against the management HTTP service, flagging repeated requests that correlate with state corruption attempts and rate limiting on the admin interface. Pair this with alerting on any new administrative session or policy change outside an approved change window.

Treat any management plane that cannot be isolated as presumed compromised until proven otherwise, and stage credential rotation for the affected consoles.

BreachSpider Intel

BreachSpider tracks exploitation activity and affected product coverage for CVE-2026-109619 across OT management infrastructure, with continuous monitoring available at BreachSpider.