CVE-2026-109619criticalunder attackCWE-1325 CWE-1419 CWE-416 CWE-755 CWE-824

CVE-2026-109619: critical vulnerability in PHP

RCE via stale global state

Published 21 Oct 2026 · Updated 28 Oct 2026

100Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a public proof of concept.

ssvc Actcvss 9.2epss 100%

from disclosure to weapon0 days

Published on NVDOct 21

1st PoCOct 21

CISA KEV+5d

exploitation probability

100%top 1% of all CVEs

observed exploitation

yesCISA + VulnCheck

78 public exploit(s)

Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

CISC Gov.br · 23 Oct 2026[Atualização] Vulnerabilidades críticas de execução remota de código PHPread on gov.br ↗
CTIR Gov · RECOMENDAÇÃO 21/2026 · 22 Oct 2026Recomendação de Segurança – PHP (CVE-2026-115560)read on gov.br ↗
CTIR Gov · RECOMENDAÇÃO 20/2026 · 22 Oct 2026Recomendação Técnica – Diretrizes de Endurecimento (Hardening): Ocultação de Banners Tecnológicos e Versõesread on gov.br ↗
CISC Gov.br · 21 Oct 2026Vulnerabilidades crí´ticas de execução remota de código PHPread on gov.br ↗
CTIR Gov · ALERTA 93/2026 · 21 Oct 2026Vulnerabilidades críticas que afeta o PHPread on gov.br ↗

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.

Action required by CISAfederal deadline: 2026-10-29

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

A flaw in PHP can leave internal memory references pointing to data from an earlier web request after that data has been freed. Attackers can use this to run their own code on the server.

Technical detail

PHP global state may keep pointers into request memory after it is freed, or be repopulated after reset, leading to use-after-free conditions (CWE-416, CWE-1325, CWE-824) and branching on uninitialized stale values in subsequent requests. Multiple triggering strategies are described, and the result is remote code execution with a CVSS score of 9.2 (Critical).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

PHP Group · PHP

public PoCs found — 78

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — PHP

In the same product, most dangerous first.

CVE-2026-109618CRITICALRCE via OOM corruptionEPSS 100.0%KEV CVE-2024-4577CRITICALArgument Injection in PHP-CGIEPSS 100.0%KEV CVE-2022-31626HIGHmysqlnd/pdo password buffer overflowEPSS 58.1%CVE-2022-31629MEDIUM$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesEPSS 49.6%CVE-2024-2756MEDIUM__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fixEPSS 38.1%CVE-2024-1874CRITICALCommand injection via array-ish $command parameter of proc_open()EPSS 32.6%

References

https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/https://cert-portal.siemens.com/productcert/html/ssa-566512.html https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp https://php2shell.delftintellab.com/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619 https://www.wiz.io/blog/php2shell-php-rce http://www.openwall.com/lists/oss-security/2026/10/21/16 http://www.openwall.com/lists/oss-security/2026/10/21/17 http://www.openwall.com/lists/oss-security/2026/10/21/23 http://www.openwall.com/lists/oss-security/2026/10/21/7 http://www.openwall.com/lists/oss-security/2026/10/22/14 http://www.openwall.com/lists/oss-security/2026/10/22/15