CVE-2026-109619
Sobre
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Análise do analista Rainforest
PHP keeps a handful of global pointers that, during a request, point into memory owned by that request. Normally they are reset when the request ends. Here they either are not reset cleanly or get repopulated after the reset, so a global ends up referencing request memory that has already been freed. A later request can then read or branch on that stale pointer before it is properly re-initialized — a textbook use-after-free, and one an attacker can shape across requests into remote code execution without credentials.
Cross-request state bugs are especially nasty because the damage does not stay in the request that caused it: a malicious request can poison state that a later, innocent request trips over, which also makes them hard to reproduce and easy to miss in logs. As with its sibling CVE-2026-109618, the blast radius is the entire PHP footprint — CMS platforms, frameworks and custom code alike. There is no configuration toggle that fully closes a use-after-free; the real remedy is upgrading to the patched PHP build. Until then, reduce exposure: keep PHP front-ends behind strict input validation, limit who can reach them, and prioritize internet-facing hosts.
Referências
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- http://www.openwall.com/lists/oss-security/2026/10/21/16
- http://www.openwall.com/lists/oss-security/2026/10/21/17
- http://www.openwall.com/lists/oss-security/2026/10/21/23
- http://www.openwall.com/lists/oss-security/2026/10/21/7
- http://www.openwall.com/lists/oss-security/2026/10/22/2
- https://www.wiz.io/blog/php2shell-php-rce
CVEs Relacionadas
Perguntas frequentes
O que é CVE-2026-109619?
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized.
Qual a gravidade de CVE-2026-109619?
CVE-2026-109619 tem pontuação base CVSS 3.1 de 9.8, classificada como critical. No Rainforest Risk Index — que pondera a gravidade junto com a facilidade de alcançar a falha e a amplitude do impacto — a nota é 99 de 100, na faixa crítico.
Como CVE-2026-109619 é explorada?
Segundo o vetor CVSS (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): vetor de ataque Rede, complexidade de ataque Baixa, privilégios necessários Nenhum, interação do usuário Nenhuma. Impacto em confidencialidade Alto, integridade Alto e disponibilidade Alto.
Quais produtos são afetados por CVE-2026-109619?
Os avisos públicos listam como afetados: php. Consulte as referências desta página para as versões exatas confirmadas por cada fornecedor.
Como corrigir CVE-2026-109619?
Aplique a correção publicada pelo fornecedor — as referências desta página levam aos avisos e patches originais. Quando não for possível corrigir de imediato, reduza a exposição do componente afetado e monitore tentativas de exploração. Clientes Rainforest recebem esta vulnerabilidade correlacionada aos próprios ativos e priorizada pela exposição real, não apenas pela nota.
Potencialize sua estratégia de segurança com a Rainforest
Descubra vulnerabilidades cedo, priorize ameaças críticas e proteja o que realmente importa. A Rainforest simplifica suas operações de segurança, economizando tempo e reduzindo custos, para você focar no que move o seu negócio.