Zyxel statement for PHP core RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

CVEs: CVE-2026-109618, CVE-2026-109619

Summary

Zyxel has been made aware of two remote code execution (RCE) vulnerabilities affecting certain versions of an open-source PHP package: CVE-2026-109618 and CVE-2026-109619. Following an investigation, Zyxel has confirmed that no Zyxel products currently available on the market are affected, as they do not incorporate the vulnerable PHP package.

What are the vulnerabilities?

CVE-2026-109618

PHP uses longjmp() to handle out-of-memory (OOM) conditions by aborting request processing and exiting the current execution context. In certain code paths, an OOM-triggered bailout can occur while request-related state is only partially initialized, leaving request memory in an invalid or uninitialized state. During request shutdown, PHP may read from this state or make control-flow decisions based on it. Multiple OOM-triggering strategies can reliably exploit this condition, potentially leading to remote code execution (RCE).

CVE-2026-109619

PHP maintains global state that may temporarily reference request-owned memory. In certain circumstances, this state may not be properly reset or may be repopulated after being cleared. As a result, it may continue to reference request-owned memory after that memory has been freed. Subsequent requests may read from or make control-flow decisions based on this stale state before it has been fully reinitialized. Multiple techniques can reliably trigger this condition and lead to remote code execution (RCE).

Got a question?

Please contact your local service rep or visit Zyxel's Community for further information or assistance.

Revision history

2026-10-28: Initial release