CVE-2026-109619

UNKNOWN 0.0

RCE via stale global state

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CWE	CWE-416 CWE-755 CWE-824 CWE-1325 CWE-1419
Vendor	php group
Product	php
Published	Oct 21, 2026
Last Updated	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for php group php

Be the first to know when new unknown vulnerabilities affecting php group php are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

PHP Group / PHP

8.2.* < 8.2.35 8.3.* < 8.3.36 8.4.* < 8.4.27 8.5.* < 8.5.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp wiz.io: https://www.wiz.io/blog/php2shell-php-rce

Credits

🔍 Wiz 🔍 Ryan at Calif.io 🔍 OpenAI Arnaud Le Blanc Ilija Tovilo Jakub Zelenka Nora Dossche