CVE-2026-109619
Acerca de
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Análisis del analista Rainforest
PHP keeps a handful of global pointers that, during a request, point into memory owned by that request. Normally they are reset when the request ends. Here they either are not reset cleanly or get repopulated after the reset, so a global ends up referencing request memory that has already been freed. A later request can then read or branch on that stale pointer before it is properly re-initialized — a textbook use-after-free, and one an attacker can shape across requests into remote code execution without credentials.
Cross-request state bugs are especially nasty because the damage does not stay in the request that caused it: a malicious request can poison state that a later, innocent request trips over, which also makes them hard to reproduce and easy to miss in logs. As with its sibling CVE-2026-109618, the blast radius is the entire PHP footprint — CMS platforms, frameworks and custom code alike. There is no configuration toggle that fully closes a use-after-free; the real remedy is upgrading to the patched PHP build. Until then, reduce exposure: keep PHP front-ends behind strict input validation, limit who can reach them, and prioritize internet-facing hosts.
Referencias
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- http://www.openwall.com/lists/oss-security/2026/10/21/16
- http://www.openwall.com/lists/oss-security/2026/10/21/17
- http://www.openwall.com/lists/oss-security/2026/10/21/23
- http://www.openwall.com/lists/oss-security/2026/10/21/7
- http://www.openwall.com/lists/oss-security/2026/10/22/2
- https://www.wiz.io/blog/php2shell-php-rce
CVEs Relacionadas
Preguntas frecuentes
¿Qué es CVE-2026-109619?
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized.
¿Qué tan grave es CVE-2026-109619?
CVE-2026-109619 tiene una puntuación base CVSS 3.1 de 9.8, calificada como critical. En el Rainforest Risk Index — que pondera la gravedad junto con lo fácil que es alcanzar la falla y la amplitud de su impacto — obtiene 99 sobre 100, en la banda crítico.
¿Cómo se explota CVE-2026-109619?
Según el vector CVSS (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): vector de ataque Red, complejidad de ataque Baja, privilegios necesarios Ninguno, interacción del usuario Ninguna. Impacto en confidencialidad Alto, integridad Alto y disponibilidad Alto.
¿Qué productos afecta CVE-2026-109619?
Los avisos públicos listan como afectados: php. Consulta las referencias de esta página para las versiones exactas que confirma cada proveedor.
¿Cómo se corrige CVE-2026-109619?
Aplica la corrección publicada por el proveedor — las referencias de esta página enlazan a los avisos y parches originales. Cuando no se pueda parchear de inmediato, reduce la exposición del componente afectado y vigila los intentos de explotación. Los clientes de Rainforest ven esta vulnerabilidad correlacionada con sus propios activos y priorizada por la exposición real, no solo por la puntuación.
Potencia tu estrategia de seguridad con Rainforest
Descubre vulnerabilidades a tiempo, prioriza amenazas críticas y protege lo que realmente importa. Rainforest simplifica tus operaciones de seguridad, ahorrando tiempo y reduciendo costos, para que te enfoques en lo que impulsa tu negocio.