PHP Stale Global State Across Requests Enables Unauthenticated RCE
Stale PHP global state may reference freed request memory, which subsequent requests read before it resets, enabling unauthenticated RCE. CVSS 9.8 critical. Patched in PHP 8.3.36, 8.4.27, and 8.5.12.
- Vendor
- PHP
- Product
- PHP core (before 8.3.36, 8.4.x before 8.4.27, 8.5.x before 8.5.12)
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Is CVE-2026-109619 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-109619 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-22 snapshot. That can change quickly; check the write-up below for the latest reporting.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
CVE-2026-109619 timeline
- Exploitation reportedsame day as NVDExploitation attempts detected on sensors same day patches shipped
- Published to NVD
- Patch availablesame day as NVDFixed in PHP 8.3.36, 8.4.27, 8.5.12
- First 0dayNews coverage+1d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-109619 is the second of two PHP core remote code execution flaws in the PHP2Shell disclosure. Both carry a CVSS 9.8 critical rating from NVD.
PHP maintains various global state that temporarily points into request memory. In some scenarios that global state is not correctly reset after the request ends, or it gets repopulated after a reset. A subsequent request can then read or branch on that stale state before it is fully initialized with data from the new request context. Attackers can trigger this condition through multiple strategies to achieve remote code execution with no authentication required.
Cisco Talos reported that both PHP2Shell flaws are reachable via a plain HTTP request before any application code executes. SecurityWeek observed exploitation attempts on sensors within hours of patches going live.
Affected installs include WordPress, Drupal, Joomla, and any PHP application backed by a vulnerable runtime.
Remediation: Update to PHP 8.3.36, 8.4.27, or 8.5.12. PHP 8.0, 8.1, and 8.2 are end-of-life and will receive no patch; those deployments require a PHP version upgrade.
Sources: NVD, Rapid7 analysis, BleepingComputer.
Other PHP CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-109618 PHP OOM Handling Memory Corruption Enables Unauthenticated RCEwrite-up | [ CRITICAL ] | 9.8 | — | — |
| CVE-2016-10033 PHPMailer Command Injection Vulnerability | [ CRITICAL ] | 9.8 | 99.7% | |
| CVE-2019-11043 PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerabilityransomware use | [ HIGH ] | 8.7 | 99.7% | |
| CVE-2012-1823 PHP-CGI Query String Parameter Vulnerability | [ CRITICAL ] | 9.8 | 100.0% |
