Two critical vulnerabilities in the PHP core runtime are drawing attention across the industry. After a full review, the OPSWAT Application Security team confirmed that no OPSWAT product is affected. Customers don’t need to take any action.
Cosa è successo
On October 21, 2026, CVE (Common Vulnerabilities and Exposures) entries CVE-2026-109618 and CVE-2026-109619 were published for the PHP interpreter. Both are critical RCE (remote code execution) flaws. In CVE-2026-109618, PHP aborts a request after running out of memory, and some code paths can leave request memory uninitialized for the cleanup that follows. Attackers can use this to execute code remotely without authentication. In CVE-2026-109619, PHP aborts a request after a fatal error, and some code paths can leave internal state pointing to memory that has already been freed. In both cases, attackers can use this to execute code remotely without authentication.
OPSWAT Assessment
The OPSWAT Application Security team reviewed the software composition of all supported products, including the MetaDefender™ platform, hardware appliances, cloud services, and My OPSWAT™ Portal. The review found the following:
- No OPSWAT product includes or depends on the PHP runtime
- No OPSWAT product is affected by either vulnerability
- No customer action is required
The full list of products reviewed is available in the OPSWAT security advisory.
Stay Informed
OPSWAT assesses third-party vulnerabilities across its portfolio as they are disclosed and publishes the results so customers can respond with confidence.
Questions? Contact us at security.incident@opswat.com.
