Summary

The Brocade Product Security Team has become aware of  two vulnerabilities are memory-safety vulnerabilities stemming from improper handling of fatal errors, specifically out-of-memory errors, during request processing in PHP.

When a request terminates unexpectedly due to these errors, the internal PHP state can become corrupted. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code, compromise affected servers, access sensitive data, or deface hosted websites.

Futher information are at:

• CISA Alert: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
• https://www.php.net/archive/2026.php#2026-10-21-5
• https://www.wiz.io/blog/php2shell-php-rce
• https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

The vulnerabilities:

RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid. 

• CWE-416: Use after free
• CWE-755: Improper Handling of Exceptional Conditions
• CWE-824: Access of uninitialized pointer
• CWE-1325: Improperly controlled sequential memory allocation
• CWE-1419: Incorrect Initialization of Resource

Score    Severity    Version    Vector String
9.2    CRITICAL    4.0    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

• CWE-416: Use after free
• CWE-755: Improper Handling of Exceptional Conditions
• CWE-824: Access of uninitialized pointer
• CWE-1325: Improperly controlled sequential memory allocation
• CWE-1419: Incorrect Initialization of Resource

Score    Severity    Version    Vector String
9.2    CRITICAL    4.0    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Products Confirmed Not Affected

• Brocade Fabric OS : Component_not_present
• Brocade ASCG: Component_not_present
• Brocade SANnav: Component_not_present
• Brocade Fabric OS products are not affected by these vulnerabilities.

Revision History

Disclaimer

THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.