CVEvulnerability

CVE-2026-109619

9.2 CRITICAL Known exploited Published 2026-10-21 Modified 2026-10-28 Official page ↗

CISA Known Exploited Vulnerability

PHP Stale Internal Request-State Vulnerability — PHP Group PHP

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.

Added to KEV: 2026-10-26
Remediation due: 2026-10-29
Ransomware use: Unknown
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109619

Status: Analyzed
Published: 2026-10-21
Last modified: 2026-10-28
Assigner: [email protected]
CVSS 4.0 ([email protected]): 9.2 CRITICAL — CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected]): 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-1325, CWE-416, CWE-755, CWE-824

Description

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Affected configurations

• php php (>= 5.4.0 < 8.2.35) • php php (>= 8.3.0 < 8.3.36) • php php (>= 8.4.0 < 8.4.27) • php php (>= 8.5.0 < 8.5.12) • siemens ruggedcom ape1808 firmware • paloaltonetworks pan-os (>= 10.2.0 < 10.2.7) • paloaltonetworks pan-os 10.2.7 • paloaltonetworks pan-os 10.2.8 • paloaltonetworks pan-os 10.2.9 • paloaltonetworks pan-os 10.2.10 • paloaltonetworks pan-os 10.2.11 • paloaltonetworks pan-os 10.2.12 • paloaltonetworks pan-os 10.2.13 • paloaltonetworks pan-os 10.2.14 • paloaltonetworks pan-os 10.2.15 • paloaltonetworks pan-os 10.2.16 • paloaltonetworks pan-os 10.2.17 • paloaltonetworks pan-os 10.2.18 • paloaltonetworks pan-os (>= 11.1.0 < 11.1.4) • paloaltonetworks pan-os 11.1.4 • paloaltonetworks pan-os 11.1.5 • paloaltonetworks pan-os 11.1.6 • paloaltonetworks pan-os 11.1.7 • paloaltonetworks pan-os 11.1.8 • paloaltonetworks pan-os 11.1.9 • paloaltonetworks pan-os 11.1.10 • paloaltonetworks pan-os 11.1.11 • paloaltonetworks pan-os 11.1.12 • paloaltonetworks pan-os 11.1.13 • paloaltonetworks pan-os 11.1.14 • paloaltonetworks pan-os 11.1.15 • paloaltonetworks pan-os 11.1.16 • paloaltonetworks pan-os (>= 11.2.0 < 11.2.4) • paloaltonetworks pan-os 11.2.4 • paloaltonetworks pan-os 11.2.5 • paloaltonetworks pan-os 11.2.6 • paloaltonetworks pan-os 11.2.7 • paloaltonetworks pan-os 11.2.8 • paloaltonetworks pan-os 11.2.9 • paloaltonetworks pan-os 11.2.10 • paloaltonetworks pan-os 11.2.11 • paloaltonetworks pan-os 11.2.12 • paloaltonetworks pan-os 11.2.13 • paloaltonetworks pan-os 11.2.15 • paloaltonetworks pan-os 11.2.16 • paloaltonetworks pan-os (>= 12.1.0 < 12.1.4) • paloaltonetworks pan-os 12.1.4 • paloaltonetworks pan-os 12.1.5 • paloaltonetworks pan-os 12.1.6 • paloaltonetworks pan-os 12.1.7 • paloaltonetworks pan-os 12.1.8 • paloaltonetworks pan-os 12.1.9 • paloaltonetworks pan-os 12.1.10 • paloaltonetworks pan-os (>= 12.2.0 < 12.2.4) • paloaltonetworks pan-os 12.2.4 • paloaltonetworks pan-os • paloaltonetworks panorama virtual appliance

Weakness · CWE (4)

CWE-1325 Improperly Controlled Sequential Memory Allocation weakness
CWE-416 Use After Free weakness
CWE-755 Improper Handling of Exceptional Conditions weakness
CWE-824 Access of Uninitialized Pointer weakness

References

https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp Mitigation, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/21/16 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/21/17 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/21/23 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/21/7 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/22/14 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/22/15 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/22/16 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/22/19 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/22/2 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/22/20 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/23/4 Mailing List, Third Party Advisory
https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/ Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-566512.html Third Party Advisory
https://php2shell.delftintellab.com/ Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619 US Government Resource
https://www.wiz.io/blog/php2shell-php-rce Third Party Advisory