CVE-2026-109619
About
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Rainforest analyst review
PHP keeps a handful of global pointers that, during a request, point into memory owned by that request. Normally they are reset when the request ends. Here they either are not reset cleanly or get repopulated after the reset, so a global ends up referencing request memory that has already been freed. A later request can then read or branch on that stale pointer before it is properly re-initialized — a textbook use-after-free, and one an attacker can shape across requests into remote code execution without credentials.
Cross-request state bugs are especially nasty because the damage does not stay in the request that caused it: a malicious request can poison state that a later, innocent request trips over, which also makes them hard to reproduce and easy to miss in logs. As with its sibling CVE-2026-109618, the blast radius is the entire PHP footprint — CMS platforms, frameworks and custom code alike. There is no configuration toggle that fully closes a use-after-free; the real remedy is upgrading to the patched PHP build. Until then, reduce exposure: keep PHP front-ends behind strict input validation, limit who can reach them, and prioritize internet-facing hosts.
References
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- http://www.openwall.com/lists/oss-security/2026/10/21/16
- http://www.openwall.com/lists/oss-security/2026/10/21/17
- http://www.openwall.com/lists/oss-security/2026/10/21/23
- http://www.openwall.com/lists/oss-security/2026/10/21/7
- http://www.openwall.com/lists/oss-security/2026/10/22/2
- https://www.wiz.io/blog/php2shell-php-rce
Related CVEs
Frequently asked questions
What is CVE-2026-109619?
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized.
How severe is CVE-2026-109619?
CVE-2026-109619 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2026-109619 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2026-109619?
Public advisories list the following as affected: php. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2026-109619?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.