by Kastro
Paper/Archive/CVE-2026-109619

CVE-2026-109619

PHP Group PHP — RCE via stale global state

KEV · due 29 OctEPSS 100%public exploitSSVC actCVSS 9.2
critical.is priorityof 100
98
CVSS 9.2 (CNA)9.2 / 10 × 3027.6In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Affected

ProductAffectedFixed inSource
PHP8.2.* – < 8.2.358.2.35CNA
PHP8.3.* – < 8.3.368.3.36CNA
PHP8.4.* – < 8.4.278.4.27CNA
PHP8.5.* – < 8.5.128.5.12CNA
RUGGEDCOM APE1808all versions–siemens-SADP

Scores by source

php (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

advisorygithub.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rpwriteupwiz.io/blog/php2shell-php-rcerefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619writeupphp2shell.delftintellab.comwriteuparcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-executionrefopenwall.com/lists/oss-security/2026/10/21/7refopenwall.com/lists/oss-security/2026/10/21/16refopenwall.com/lists/oss-security/2026/10/21/17refopenwall.com/lists/oss-security/2026/10/21/23refopenwall.com/lists/oss-security/2026/10/22/2refopenwall.com/lists/oss-security/2026/10/22/14refopenwall.com/lists/oss-security/2026/10/22/15refopenwall.com/lists/oss-security/2026/10/22/16refopenwall.com/lists/oss-security/2026/10/22/19refopenwall.com/lists/oss-security/2026/10/22/20refopenwall.com/lists/oss-security/2026/10/23/4refcert-portal.siemens.com/productcert/html/ssa-566512.htmlkevcisa.gov/known-exploited-vulnerabilities-catalog