CVE-2026-109619
Undergoing Analysis Undergoing Analysis - In Progress

Remote Code Execution in PHP Core Due to Stale Global State

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: PHP Group

Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-10-21
AI Q&A
2026-10-21
EPSS Evaluated
N/A
NVD
CVE-2026-109619
EUVD
EUVD-2026-107265

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
PHP Group PHP 8.2.*
PHP Group PHP 8.3.*
PHP Group PHP 8.4.*
PHP Group PHP 8.5.*

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-824 The product accesses or uses a pointer that has not been initialized.
CWE-1325 The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
CWE-755 The product does not handle or incorrectly handles an exceptional condition.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109619 is a critical remote code execution (RCE) vulnerability in PHP. It occurs when PHP workers retain stale global state after a request completes. This stale state can be exploited through a use-after-free condition, where subsequent requests access uninitialized memory before it is properly reset. Exploitation requires a producer (e.g., fatal errors) and a consumer (e.g., INI diagnostics) in separate requests handled by the same worker.

The vulnerability affects PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12. It has been confirmed in mod_php and PHP-FPM environments.

Detection Guidance

Detecting this vulnerability requires checking PHP version and configuration. Use commands like 'php -v' to verify PHP version against patched releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Inspect logs for fatal errors or session-related issues in mod_php or PHP-FPM environments.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your server remotely. It can lead to full system compromise, data theft, or unauthorized access. Attackers may exploit it by crafting malicious requests that trigger the stale state condition, enabling them to run commands with the privileges of the PHP process.

Compliance Impact

This vulnerability can severely impact compliance with GDPR, HIPAA, and other regulations. A successful RCE attack may result in unauthorized data access, breaches of confidentiality, or integrity violations. Organizations could face legal penalties, reputational damage, and mandatory breach notifications under these regulations.

Mitigation Strategies

Immediately update PHP to a patched version (8.2.35, 8.3.36, 8.4.27, or 8.5.12). Disable 'fatal_error_backtraces' and 'session.upload_progress.enabled' in php.ini. Reduce fatal errors in attacker-reachable paths and audit logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109619. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart