Security Advisory
Cybersecurity
As IoT adoption continues to proliferate, cybersecurity has become one of the top priorities. Aten created a vulnerability management policy to provide guidance and information to our customers in the event of a reported vulnerability. The management policy ensures that Aten's customers have steady, unambiguous resources to help them understand how Aten resolves or mitigates reported vulnerabilities.
CVE-2026-109618
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Release Date: 2026/10/27
Vulnerability Scoring Details :
The vulnerability scores and vectors are listed below.
| Severity | CVSS Score | Vector |
|---|---|---|
| CRITICAL | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
We have conducted a security assessment of CVE-2026-109618 and CVE-2026-109619 to evaluate their potential impact on our products.
The assessment covers all currently supported versions of our products.
Based on our current assessment, we have not identified any use of the affected PHP components in our products. Therefore, no impact on our products has been identified, and no product-specific remediation is currently required.
Customers who use PHP in their own environments are advised to review their PHP installations and refer to the relevant official security advisories to determine whether additional actions are necessary.
We will continue to monitor these vulnerabilities and update this advisory if new information or changes to our assessment become available.
For further information or security-related inquiries, please contact our Technical Support Team.
