CVE-2026-109619
PHP has various global state that temporarily points into request memory
- Risk score
- 87/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 6.2%
- Published
- 24 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- PHP has a vulnerability where global state temporarily points into request memory, potentially leading to remote code execution (RCE). An attacker could exploit this to execute arbitrary code on a vulnerable system.
- Affected
- {'product': 'php', 'vendor': 'php'}
- Fix
- Check the linked advisory for a fix, as none is specified in this record.
- Exploitation
- Exploitation reported in the press
In the news
TL;DR
PHP has a high-severity vulnerability (CVE-2026-109619) that allows remote code execution without logging in, affecting PHP installations. The PHP team has released emergency security updates to fix the issue, and experts are downplaying the viability of exploits.
- The PHP security team has released emergency security updates to fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in.
- The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the team is strongly urging administrators to update their installations as soon as possible.
- SecurityWeek reports that threat actors have tried to use the flaws to spread a Mirai botnet, but no successful in-the-wild compromise has been confirmed so far.
- Experts are downplaying the viability of exploits, with some arguing that most available proof-of-concept (PoC) exploits only work in ideal lab conditions.
AI summary of 12 articles.
- Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw
- Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
- PHP shares mitigation for new RCE vulnerability with no patch
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
- Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
- Amazon says PHP2Shell exploitation began 4 days before patches
- PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
- Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
- 'PHP2Shell' Bugs Signal Red Alert for Security Industry
- Widespread PHP Flaw May Cause Many Site Outages Today
Why it is Red
- CVSS 8.1 high
- Exploitation likely: EPSS 6.2% (top 6%)
- Remotely exploitable without logging in
- On your watchlist: php
- Named in a government or vendor bulletin
Government and vendor bulletins
- Informational advisory: Session upload progress
- PHP 8.6.0 RC4 available for testing
- USN-8948-2: PHP vulnerabilities
- Critical Vulnerabilities in PHP Require Immediate Patching
- Critical security issue affecting PHP
- Security advisory: Critical remote code execution vulnerabilities, update now
- PHP 8.5.12 Released!
- PHP 8.4.27 Released!
- PHP 8.3.36 Released!
- PHP 8.2.35 Released!
References
- https://ubuntu.com/security/notices/USN-8948-2
- https://www.php.net/index.php#2026-10-21-5
- https://www.php.net/index.php#2026-10-21-4
- https://www.php.net/index.php#2026-10-21-3
- https://www.php.net/index.php#2026-10-21-2
- https://www.php.net/index.php#2026-10-21-1
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- http://www.openwall.com/lists/oss-security/2026/10/21/16
- http://www.openwall.com/lists/oss-security/2026/10/21/17
- http://www.openwall.com/lists/oss-security/2026/10/21/23
Original description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Last activity 23 Oct 2026. Patch Forecast updates every hour.