CVE-2026-109619GHSA-6wmf-4rv5-p3rp
PHP: RCE via stale global state
PHP Group PHPRuntimes & languagesCVSS
9.2CriticalExploitationExploitation reported23 outlets report it, first 21 Oct 2026. Not yet in the KEV catalogReports
Exploit odds (EPSS)5.99%Chance of exploitation activity in the next 30 days, higher than 93% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 8.2.35PHPCVE List
- 8.3.36PHPCVE List
- 8.4.27PHPCVE List
- 8.5.12PHPCVE List
- 8.2.35php-src, phpGitHub
- 8.3.36php-src, phpGitHub
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
- 21 Oct 2026, 01:54 UTCFirst reported exploitedAikido
- 21 Oct 2026, 13:54 UTCPublishedCVE List
- 21 Oct 2026, 15:22 UTCExploit code publicRapid7
- 22 Oct 2026, 00:00 UTCWAF rule availableCloudflare WAF
- NowNot on CISA's known exploited list yet
Protection while you patch 1
WAF and edge providers that shipped rules for this CVE. A rule can block known attack patterns; it does not fix the software, so still upgrade.
Vendor and government advisories 10
Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.
- CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)Palo Alto Networks, 23 Oct 2026Vendor
- Vulnerabilities in PHP Affecting Cisco Products: October 2026Cisco PSIRT, 23 Oct 2026Vendor
- Informational advisory: Session upload progressPHP, 23 Oct 2026Vendor
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)SANS Internet Storm Center, 21 Oct 2026Government
- USN-8948-2: PHP vulnerabilitiesUbuntu security notices, 21 Oct 2026Vendor
- Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619Google Cloud security, 21 Oct 2026Vendor
- Critical Vulnerabilities in PHP Require Immediate PatchingCISA advisories, 21 Oct 2026Government
- Critical security issue affecting PHPNCSC UK, 21 Oct 2026Government
- PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)Fortinet PSIRT, 21 Oct 2026Vendor
- [Màj] Multiples vulnérabilités dans PHP (21 octobre 2026)CERT-FR alerts, 21 Oct 2026Government
Reports 76
23 outlets report exploitation. Reports are not confirmation; each links to its source.
- @bookness.bsky.social: 【カーリル】PHPの重大な脆弱性（CVE-2026-109618／CVE-2026-109619）によるカーリルへの影響について blog.calil.jp/2026/10/php.... >カーリルが提供する各サービス（カーリル、Unitrad API、カーリル for AI、学校図書館支援プログラムなど）は、PHPを使用していません。そのため、本脆弱性にBluesky: CVE posts, 24 Oct 2026
- akamor2800/php-5.4-cve-2026-php2shell-patch: Production-ready backported .patch for EOL PHP 5.4,.23 custom 5.x to fix the critical PHP2Shell (OOM) vulnerability (CVE-2026-109618 / CVE-2026-109619).GitHub proof-of-concept repositories, 24 Oct 2026Exploit code
- @indirlab.com: PHP dilindeki kritik PHP2Shell açıkları interneti nasıl felaketin eşiğine getirdi? CVE-2026-109618 ve CVE-2026-109619 açıklarının detayları haberimizde. 👇 https://indirlab.com/habeBluesky: CVE posts, 24 Oct 2026
- @alt.pds.lefht.cc: 3. CVE-2026-109619 · 38 people 🟥 Critical 9.2 · PHP RCE via stale global stateBluesky: CVE posts, 24 Oct 2026
- @alt.pds.lefht.cc: 🛡️ Most-discussed CVEs on Bluesky, last 24h 1. CVE-2026-111497 · 55 people 2. CVE-2026-109618 · 50 people 3. CVE-2026-109619 · 38 people 4. CVE-2026-115560 · 20 people 5. CVE-2026-Bluesky: CVE posts, 24 Oct 2026Exploitation reported
- utkarsssh17/cve-2026-109619-php-uaf-pocGitHub proof-of-concept repositories, 24 Oct 2026Exploit code
- @privpros.bsky.social: Two long-dormant PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) enabled passwordless compromise of PHP servers, prompting urgent patching worldwide.Bluesky: CVE posts, 24 Oct 2026
- @infosecbriefly.bsky.social: Two long-dormant PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) enabled passwordless compromise of PHP servers, prompting urgent patching worldwide.Bluesky: CVE posts, 24 Oct 2026
- @devopsbriefly.bsky.social: Two long-dormant PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) enabled passwordless compromise of PHP servers, prompting urgent patching worldwide.Bluesky: CVE posts, 24 Oct 2026
- @internoticies.pongo.cat: Dos vulnerabilitats crítiques en el llenguatge PHP, denominades PHP2Shell (CVE-2026-109618 i CVE-2026-109619), han permès l'accés remot sense contrasenya a milions de servidors webBluesky: CVE posts, 24 Oct 2026
Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Text from CVE List
Affected versions 8
- PHPaffected: 8.2.* before 8.2.35CVE List
- PHPaffected: 8.3.* before 8.3.36CVE List
- PHPaffected: 8.4.* before 8.4.27CVE List
- PHPaffected: 8.5.* before 8.5.12CVE List
- php-src, php< 8.2.35GitHub
- php-src, php< 8.3.36GitHub
- php-src, php< 8.4.27GitHub
- php-src, php< 8.5.12GitHub