What are you looking for?
Security Advisory: PHP Vulnerability
CVE-2026-109618 and CVE-2026-109619
October 30, 2026
Overview
Keysight is aware of two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619, reported in the PHP scripting language that may allow remote code execution (RCE). Both were publicly disclosed on October 21, 2026, and the PHP project rates each 9.2 (critical) on the CVSS v4.0 scale. Exploitation attempts have been reported publicly.
CVE-2026-109618 involves improper handling of out-of-memory conditions that can leave request memory in an invalid or partially initialized state, potentially resulting in memory corruption during request cleanup and RCE. CVE-2026-109619 involves PHP request state that may continue to reference memory after it has been freed; a subsequent request on the same worker may use this stale state before it is fully initialized, which can also result in RCE. The PHP project has released fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
As of October 27, Keysight continues to evaluate the potential impact of these vulnerabilities across its entire product portfolio. Based on assessments completed to date, most Keysight IP Traffic, Wireless and Security Emulators, and Network Operations Monitoring products (formerly Ixia NAS) are not affected¹ because they either do not use PHP or the affected PHP component has been removed from the applicable software release. For products identified as affected, the list below provides the applicable vulnerability status and recommended remediation or mitigation measures.
Impacted Products, Mitigation and Recommended Action
| Impacted Product | Mitigation | Recommended Action |
|---|---|---|
| Hawkeye — Potentially impacted by CVE-2026-109619. Hawkeye uses PHP 8.2.33 with Nginx. Engineering determined that Hawkeye is not affected by CVE-2026-109618. Exposure to CVE-2026-109619 is considered unlikely but has not been conclusively ruled out. | Keysight is preparing an update to PHP 8.2.35 in release v6.1.1-101. | Customers should monitor Keysight Support and install the applicable software update when available. |
| iBypass HD — Vulnerable when the web server is enabled iBypass HD uses PHP 5.6.31. The product is End-of-Development, and no new software release is planned. | The web server is disabled by default. If it was explicitly enabled, disable it using the CLI command shown under Recommended Action. | Customers should keep the web server disabled. If the web server was enabled, disable it from the CLI with: websrv set admin=disable |
Products Assessed as Not Vulnerable
| Products Assessed as Not Vulnerable | Recommended Action |
|---|---|
| Vision Network Packet Brokers running NVOS 6.6.0 or newer The relevant PHP component was removed beginning with release 6.6.0. This assessment includes Vision 7300, Vision Edge 10S (E10S), Vision Edge 40 (E40), Vision Edge 50 (E50), Vision Edge 100 (E100), Vision 7712, Vision 7816, Vision X, Vision ONE, TradeVision, Vision 400, Vision Edge 400P (E400P), Vision 400XT (V400XT), Vision X 400G (VX 400G), Vision Edge OS - 9516 (9516), Vision Edge 400P Rev2 (E400P Rev2) and Vision Edge 400S (E400S). | Customers should confirm that systems run NVOS 6.6.0 or newer. Customers running an earlier release should contact Keysight Support for specific guidance. |
Vision Industrial Network Packet Brokers | No action is required |
| Visibility Software and Cloud products Keysight Vision Orchestrator (KVO), Virtual Packet Broker (vPB), 5G Service-Based Interface (5G SBI), CloudLens vTAP, AppStack and TimeKeeper do not use PHP. | No action is required |
| iBypass and iLinkAgg products IXPR-CU3, IXTP-CU3, IXBP-CU3, iBypass DUO, iBypass 100G, iBypass VHD and iLinkAgg2 do not use PHP. The remaining assessed portfolio does not use PHP or does not provide a PHP-based graphical interface. | No action is required |
| ThreatARMOR products | No action is required |
| IFC-CM (Indigo Pro) | No action is required |
| Network Test products IxNetwork does not use PHP Web Runtime; IxNetwork VE/Virtual Editions, and BreakingPoint VE are not vulnerable; IxLoad, CyPerf, BreakingPoint System (BPS), IxOS, IxVeriwave, LoadCore, and KCOS do not use PHP. | No action is required |
For products or releases not explicitly listed, contact Keysight Support for a product-specific assessment.
Vulnerability Details
| CVE | Description | CVSS v4.0 | Fixed in PHP |
|---|---|---|---|
| CVE-2026-109618 | Remote code execution via out-of-memory corruption: an interrupted request leaves internal data partially initialized, and request cleanup treats it as valid. | 9.2 | 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| CVE-2026-109619 | Remote code execution via stale global state: request-owned state survives after its memory is freed and is reused by a later request on the same worker. | 9.2 | 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
The PHP project states that all PHP installations serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP versions 8.1 and earlier no longer receive updates from the PHP project.
Potential Impact
- Execution of attacker-controlled code on a vulnerable web server without authentication, which can lead to access to the file system and databases and disruption of services.
- Possible disclosure of memory contents, such as credentials, keys or session data.
A compromised management interface can serve as a foothold into the surrounding network.
For additional questions, please contact Keysight.
1 Keysight used commercially reasonable efforts to compile the list of products affected by the PHP vulnerability. Keysight offers this information for your convenience and does not warrant it is complete.
Want help or have questions?