CVE-2026-109619
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X- github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rpMitigationVendor Advisory
- openwall.com/lists/oss-security/2026/10/21/16Mailing ListThird Party Advisory
- openwall.com/lists/oss-security/2026/10/21/17Mailing ListThird Party Advisory
- openwall.com/lists/oss-security/2026/10/21/23Mailing ListThird Party Advisory
- openwall.com/lists/oss-security/2026/10/21/7Mailing ListThird Party Advisory
- openwall.com/lists/oss-security/2026/10/22/14Mailing ListThird Party Advisory
- openwall.com/lists/oss-security/2026/10/22/15Mailing ListThird Party Advisory
- openwall.com/lists/oss-security/2026/10/22/16Mailing ListThird Party Advisory
- openwall.com/lists/oss-security/2026/10/22/19Mailing ListThird Party Advisory
- openwall.com/lists/oss-security/2026/10/22/2Mailing ListThird Party Advisory
- openwall.com/lists/oss-security/2026/10/22/20Mailing ListThird Party Advisory
- openwall.com/lists/oss-security/2026/10/23/4Mailing ListThird Party Advisory
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching : CVE-2026-109618 - PHP Memory Corruption Vulnerability CVE-2026-109619 - PHP Stale Internal Request-State Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose signif
CISA Alerts · 19h ago - PHP2Shell security flaws now sucessfully exploited in the wild
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]
BleepingComputer · 22h ago - Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25) appeared first on Unit 42 .
Unit 42 · 3d ago - Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available.
SANS ISC · 5d ago - Critical Vulnerabilities in PHP Require Immediate Patching
Update October 26, 2026: CISA has updated this Alert to reflect the addition of CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 26, 2026. Update October 23, 2026 : CISA has updated this Alert to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mi
CISA Alerts · 5d ago
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- 2 days left (2026-10-29)
- CVSS
- 9.2 CRITICAL
- EPSS (30-day exploit probability)
- 100.0% · top 1% of all CVEs
- Weakness
- CWE-416
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
- 1.Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.