CVE-2026-109619
9.8CriticalPublished 21 Oct 2026 · NVD status: Modified · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-416, CWE-755, CWE-824, CWE-1325
Impact
Unauthenticated remote attackers can execute arbitrary code on the server hosting PHP. They only need network access to send standard HTTP requests that trigger stale memory reuse across requests.
Root cause
PHP fails to properly reset global state pointers referencing freed request memory, causing subsequent requests to branch on or read stale pointers.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade PHP to the patched release specified in the upstream vendor advisory GHSA-6wmf-4rv5-p3rp once available; if patching must wait, restart PHP-FPM/worker processes frequently or configure process managers to cycle workers after single requests to prevent state carryover.
$ php -vAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
References
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rpMitigationVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/16
- http://www.openwall.com/lists/oss-security/2026/10/21/17
- http://www.openwall.com/lists/oss-security/2026/10/21/23
- http://www.openwall.com/lists/oss-security/2026/10/21/7
- https://www.wiz.io/blog/php2shell-php-rceThird Party Advisory