Detections
Analytics
PHP < 8.2.35 / 8.3.x < 8.3.36 / 8.4.x < 8.4.27 / 8.5.x < 8.5.12 Multiple Vulnerabilities
critical Nessus Plugin ID 369483
Language:
Synopsis
The version of PHP installed on the remote host is affected by multiple vulnerabilities.Description
The version of PHP installed on the remote host is prior to 8.2.35, 8.3.x prior to 8.3.36, 8.4.x prior to 8.4.27, or 8.5.x prior to 8.5.12. It is, therefore, affected by multiple remote code execution vulnerabilities as referenced in the 21 October 2026 PHP security advisory.- PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.
Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory.
Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
(CVE-2026-109618)
- PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
(CVE-2026-109619)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to PHP version 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.See Also
https://www.php.net/archive/2026.php#2026-10-21-5
Plugin Details
Severity: Critical
ID: 369483
File Name: php_2026_10_21.nasl
Version: 1.4
Type: Combined
Agent: windows, macosx, unix
Family: CGI abuses
Published: 10/21/2026
Updated: 10/22/2026
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.2
Percentile: 99.77
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-109619
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 9.2
Threat Score: 7.2
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
CPE: cpe:/a:php:php
Required KB Items: installed_sw/PHP
Exploit Ease: No known exploits are available
Patch Publication Date: 10/21/2026
Vulnerability Publication Date: 10/21/2026