CVE-2026-109619

RCE via stale global state

No known exploitation. EPSS puts it in the 93rd percentile. Fixed versions are out.

CVSS 3.19.8Critical EPSS percentile93rd5.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1 product4 fixed builds listed below

Published 2026-10-21Updated 2026-10-22Sources: CVE.org, NVD, CSAF

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

PHP Group PHPAffected: ≥ 8.2.*, < 8.2.35Upgrade to: 8.2.35Affected: ≥ 8.3.*, < 8.3.36Upgrade to: 8.3.36Affected: ≥ 8.4.*, < 8.4.27Upgrade to: 8.4.27Affected: ≥ 8.5.*, < 8.5.12Upgrade to: 8.5.12Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Ask your developer or host which PHP version your websites and applications currently run.
If it's older than the fixed versions below, treat this as urgent — attackers are actively exploiting it.
Upgrade PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (whichever matches your current major version).
Restart web server / PHP-FPM services after upgrading so the fix takes effect.
Ask your host or developer to confirm there's no leftover old PHP process still running.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

14 publishers

Exploitation reported in the wild
as reported · Oct 22, 2026·BleepingComputer summary
Advisory coverage
as reported · Oct 22, 2026·SecurityWeek summary
Technical analysis published
as reported · Oct 22, 2026·Help Net Security summary
Proof-of-concept published
as reported · Oct 21, 2026·Kaspersky Securelist summary
Vendor patch released
as reported · Oct 21, 2026·Cisco Talos summary

Sourced from public security reporting — each date is when it was published, not when it happened. 6 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

In plain language

Written by AI from the record

A serious flaw in PHP itself lets attackers take over servers remotely with no login needed, and it's already being actively attacked, so if you run PHP-based websites or apps you need to patch now.

Unauthenticated remote code execution in PHP caused by stale global state pointing to freed request memory, which attackers trigger via crafted sequences of requests to hijack execution flow; exploitation is already confirmed in the wild.

If you're affected

Full server takeover
Website defacement or outage
Data theft from server
Ransomware deployment risk
Use of server to attack others

What is it

PHP is the engine that runs behind the scenes on a huge number of websites. This bug is like a filing clerk who sometimes forgets to clear out an old customer's paperwork before helping the next customer — an attacker can exploit that mix-up to slip in instructions that make the server do whatever they want, including running their own commands.

Who is affected

This matters to you if any part of your website, online store, or internal tools runs on PHP — this includes most WordPress, Laravel, Magento, and custom PHP sites. No login or user interaction is needed, so if your server is reachable from the internet (which is almost always true for a live website), it is at risk.

How urgent is it

Attackers are already exploiting this flaw in the wild — security researchers observed active attacks within hours of disclosure, and government websites in Europe reportedly went offline as a result. This is not a theoretical risk; treat it as an active, ongoing attack and patch immediately rather than scheduling it for later.

What to do — in detail

Identify every server and container running PHP, including those behind load balancers or managed by hosting providers, and record the exact PHP version on each.
Prioritize internet-facing PHP instances first, since the vector is network-based and requires no authentication.
Upgrade to the fixed release matching your branch: 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
Test the upgrade in staging if you rely on version-specific extensions, since minor-version bumps can occasionally affect compiled extensions (opcache, PECL modules) — rebuild/reinstall extensions after upgrading.
If immediate patching isn't possible, consult the GitHub Security Advisory referenced in the patch findings for interim mitigation strategies, and consider placing a WAF in front of the application (Cloudflare has already deployed rules blocking known attack patterns).
After patching, monitor web server and PHP-FPM error logs for crash patterns or segfaults around request handling, which can indicate attempted exploitation of the use-after-free condition.
No CISA KEV due date applies since this CVE is not yet listed in KEV, but given confirmed in-the-wild exploitation, treat remediation with KEV-equivalent urgency.

Technical context

This is an unauthenticated, network-reachable remote code execution vulnerability rooted in a use-after-free (CWE-416) combined with improper resource initialization (CWE-1419) and exception-handling weaknesses (CWE-755, CWE-824, CWE-1325): PHP's global state can retain a pointer into request memory that has already been freed, and subsequent requests act on this stale/uninitialized state before proper reinitialization, enabling attacker-controlled branching or memory corruption leading to code execution. Exploitation has been confirmed by news reporting (Cloudflare detected attacks within hours of disclosure and deployed WAF rules), overriding predicted-risk scoring; no public PoC is on record and the CVE is not yet in CISA's KEV catalog, but real-world exploitation is already documented independent of KEV status. No CVSS score is given in the findings, but the combination of unauthenticated network access, no user interaction, and confirmed RCE places this at critical severity.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS93rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

5.8% chance of exploitation activity in the next 30 days, which ranks it in the 93rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

21 events over 5 days, from the signal feeds we watch.

2026-10-26Analysis publishedAttacked from all sides? PHP, Laravel, Node.js and a CA with a key of "4": what is real
2026-10-22Analysis publishedPHP2Shell: what changed overnight and what to do nowopenvas check added, patch available, patch available, workaround available, workaround available, record updated, record updated
2026-10-21Analysis publishedPHP2Shell (CVE-2026-109618, CVE-2026-109619): how to protect your PHP servers. Full guidepatch available, patch available, workaround available, workaround available, workaround available, published, weakness classified, att&ck mapped, record updated, record updated, record updated

Affected products

phposs-project · USaka pear, pecl, php language
- phpDev ToolOSS Libraries / generic-library
PHP Grouposs-projectaka pear, php
- PHPLibraryLibraryOSS Libraries

Scale

How widely the affected products are used. This is not a count of vulnerable hosts.

Estimate Public sources, each figure dated. How much of it is already patched is not known.

PHP

Web

Usage: unknown. No public source measures this product yet.

Version split: unknown. No public source for this product.

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Initial AccessT1190Exploit Public-Facing Applicationhigh confidence
Privilege EscalationT1068Exploitation for Privilege Escalationhigh confidence

Sources

References in the record

And 9 more references. See all after sign-in

Analysis on the cve.tools blog

In the news

All news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for PHP, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account