CVE-2026-109619

CVE-2026-109619 is a flaw in PHP core. PHP calls it "RCE via stale global state". It was fixed on 21 October 2026.

A PHP worker keeps some global state between requests. Some of it points to memory owned by one request. If that state is not reset, the memory is freed while the pointer stays. A later request on the same worker can use it before normal setup. This is a use-after-free.

A fatal error, including one from running out of memory, can skip the reset. A late warning can also refill error state after cleanup.

PHP confirmed two paths. The first is fatal error backtraces in PHP 8.5, when fatal_error_backtraces is on. It is the basis of the confirmed mod_php exploit. The second is the session upload progress feature, which is on by default. That RCE was validated against mod_php and FPM. The FPM path needs a suitable application operation.

The confirmed impact is unauthenticated remote code execution, plus memory disclosure, with the web worker's rights. The attacker's requests must reach the same worker.

PHP rates it CVSS 4.0 9.2. The full vector is in the CVSS field. NVD published its entry on 21 October and added its own CVSS 3.1 score of 9.8.

Fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP also shared minimal source backports for 7.4, 8.0 and 8.1.

PHP says there is no complete configuration workaround. As stopgaps, it suggests fatal_error_backtraces=0 on PHP 8.5 and session.upload_progress.enabled=0, then a restart of every worker. Each only removes one known path.

Credits go to Wiz, Ryan at Calif.io and OpenAI, per the CVE record. The fix was built by Arnaud Le Blanc, Ilija Tovilo, Jakub Zelenka and Nora Dossche.

On 21 October, CISA issued an alert urging immediate patching. It calls the flaws "php2shell" and says they affect all PHP installations serving web requests. CISA says systems that cannot be updated, or that run PHP 8.1 or older, should go offline until patched. The UK NCSC issued a similar alert.

Vendor fixes are out from Debian, Ubuntu, Red Hat, the Docker official php images and cPanel. Researchers say the flawed code dates back to PHP 5.4, so treat older PHP as exposed. See the vendor list and full checklist.

Exploitation update, 22 October: Amazon said on October 21 that its MadPot honeypots logged a PHP2Shell exploit attempt on October 17, four days before disclosure. It does not know how the attacker got the details early, or which of the two CVEs was targeted. Amazon now says PHP2Shell is being broadly exploited in the wild. ELLIO and VulnCheck saw attempts from 08:36 UTC on October 21. No confirmed compromise is public. Read the full story.

The CVE is not in the CISA KEV catalog (catalog 2026.10.21). Cloudflare reported attack attempts before the release. CISA had observed no exploitation at publication. Detailed research write-ups are now public. ThreatWire has not verified or run any exploit code. A research repository published before the advisory, ikow/php2shell-poc, targets session upload progress. Its chains need extra app conditions, such as an LFI or a deserialization gadget. They do not match PHP's description, so ThreatWire does not count it as a confirmed PoC. ThreatWire has not run it. Read the full explainer. The twin flaw is CVE-2026-109618.