Overall Information
- Original Released Date: October 22, 2026
- Update Date: October 22, 2026
- CVE Identifier(s): CVE-2026-109618, CVE-2026-109619
- CVSS Version 4.0
- Severity: Critical
- Score: 9.2
- Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
TXOne Networks products are not affected by these vulnerabilities in their default configuration.
Description
PHP Group released security updates on October 21, 2026, to address two critical vulnerabilities:
- CVE-2026-109618:
- PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
- CVE-2026-109619:
- PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on affected systems.
TXOne Networks has completed an evaluation of our products. A summary of the status across products is provided in the table below.
| Product Line | Product Status | Note |
|---|---|---|
| Edge | Not Affected | No PHP component |
| Stellar | Not Affected | Safe Lock TXOne Edition has PHP component, but not affected in default configuration |
| Element | Not Affected | No PHP component |
| Sennin | Not Affected | No PHP component |
Solution
No action is required for TXOne Networks products in their default configuration.
For Safe Lock TXOne Edition customers, TXOne Networks recommends the following steps on the host:
- Check the PHP version by running the following command:
- php -v
- If the PHP version is 5.4 or later, update PHP to one of the following fixed versions or later:
| Component | Fixed Version(s) |
|---|---|
| PHP 8.5 | 8.5.12 or later |
| PHP 8.4 | 8.4.27 or later |
| PHP 8.3 | 8.3.36 or later |
| PHP 8.2 | 8.2.35 or later |
- Until the update is completed, applying the following mitigations can reduce the risk of exploitation:
- In php.ini, set:
session.upload_progress.enabled = 0
memory_limit = -1 - Restart IIS to apply the changes.
- In php.ini, set:
External Reference(s)
If you encounter any problems related to this vulnerability, please contact security@txone.com