The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the     request. Some contexts may not properly account for this scenario and leave request memory in an     uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or     branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote     code execution (RCE). (CVE-2026-109618)

  - A critical vulnerability has been discovered in PHP that will be addressed in a Critical PHP Security     Release on October 21, 2026. Full details have not yet been shared, but public reporting from several     trusted sources indicates this is one of the two CVEs that will be included in this release. When this     flaw is chained with another PHP vulnerability, attackers could gain remote code execution. The chain has     been dubbed php2shell by researchers at Calif. This description will be updated once PHP publishes full     details. (CVE-2026-109618)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-109618

critical Nessus Plugin ID 370006

Version 1.4