CVE-2026-109619 is a critical use-after-free vulnerability in PHP that involves global state pointers referencing freed request memory. This flaw can lead to remote code execution when subsequent requests interact with stale state data. The vulnerability affects multiple PHP versions and has known exploits in the wild. Fixed versions have been released to address this issue.
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can cause security ACLs on shared SVIs to stop functioning. This may result in incorrect packet permit/deny behavior.
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream networks.
When the same family inet or inet6 filter is applied on an IRB interface and on a physical interface as egress filter on EX4100, EX4400, EX4650 and QFX5120 devices, only one of the two filters will be applied, which can lead to traffic being sent out one of these interfaces which should have been blocked.
This issue affects Junos OS on EX Series and QFX Series:
* 23.4 version 23.4R2-S6,
* 24.2 version 24.2R2-S3.
No other Junos OS versions are affected.
CVE-2026-21913 is a high-severity vulnerability in Juniper Networks Junos OS affecting EX4000-48T, EX4000-48P, and EX4000-48MP models. It involves incorrect initialization of resources in the Internal Device Manager (IDM), allowing unauthenticated, network-based attackers to trigger a denial-of-service (DoS) by sending a high volume of traffic. This causes the FXPC component to crash and restart, resulting in a complete service outage until reboot. The issue affects Junos OS versions 24.4 before 24.4R2 and 25.2 before 25.2R1-S2 and 25.2R2. No user interaction or authentication is required, and the attack surface is network-exposed.
CVE-2025-24495 is an information disclosure vulnerability affecting some Intel Core Ultra Processors. It arises from incorrect initialization of a resource in the branch prediction unit. An authenticated local user with low privileges may exploit this flaw to potentially disclose sensitive information. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.8. There is no indication of known exploits in the wild or available patches at this time.