blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2026-109619

CRITICAL 9.2 CVSS 4.0
Published
October 21, 2026
Last modified
November 5, 2026
NVD status
Analyzed
Reported by
security@php.net
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Affected products and versions

  • PHP — From 5.4.0 (including) to 8.2.35 (excluding)
  • PHP — From 8.3.0 (including) to 8.3.36 (excluding)
  • PHP — From 8.4.0 (including) to 8.4.27 (excluding)
  • PHP — From 8.5.0 (including) to 8.5.12 (excluding)

References

  • github.com https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp Mitigation, Vendor Advisory
  • www.openwall.com http://www.openwall.com/lists/oss-security/2026/10/21/16 Mailing List, Third Party Advisory
  • www.openwall.com http://www.openwall.com/lists/oss-security/2026/10/21/17 Mailing List, Third Party Advisory
  • www.openwall.com http://www.openwall.com/lists/oss-security/2026/10/21/23 Mailing List, Third Party Advisory
  • www.openwall.com http://www.openwall.com/lists/oss-security/2026/10/21/7 Mailing List, Third Party Advisory
  • www.openwall.com http://www.openwall.com/lists/oss-security/2026/10/22/14 Mailing List, Third Party Advisory
  • www.openwall.com http://www.openwall.com/lists/oss-security/2026/10/22/15 Mailing List, Third Party Advisory
  • www.openwall.com http://www.openwall.com/lists/oss-security/2026/10/22/16 Mailing List, Third Party Advisory
  • www.openwall.com http://www.openwall.com/lists/oss-security/2026/10/22/19 Mailing List, Third Party Advisory
  • www.openwall.com http://www.openwall.com/lists/oss-security/2026/10/22/2 Mailing List, Third Party Advisory
  • www.openwall.com http://www.openwall.com/lists/oss-security/2026/10/22/20 Mailing List, Third Party Advisory
  • www.openwall.com http://www.openwall.com/lists/oss-security/2026/10/23/4 Mailing List, Third Party Advisory
  • arcticwolf.com https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/ Third Party Advisory
  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-166980.html Third Party Advisory
  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-566435.html Third Party Advisory
  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-566512.html Third Party Advisory
  • php2shell.delftintellab.com https://php2shell.delftintellab.com/ Third Party Advisory
  • www.cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619 US Government Resource
  • www.wiz.io https://www.wiz.io/blog/php2shell-php-rce Third Party Advisory
  • nvd.nist.gov Official NVD record