{"id":"CVE-2026-109619","summary":"RCE via stale global state","details":"PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).","aliases":["BIT-libphp-2026-109619","BIT-php-2026-109619","BIT-php-min-2026-109619","GHSA-6wmf-4rv5-p3rp"],"modified":"2026-11-11T02:55:56.381762615Z","published":"2026-10-21T13:54:43.866Z","related":["ALSA-2026:87070","ALSA-2026:87071","ALSA-2026:87072","ALSA-2026:87073","ALSA-2026:87079","ALSA-2026:87080","ALSA-2026:87151","ALSA-2026:A011","ALSA-2026:A012","ALSA-2026:A013","ALSA-2026:A014","SUSE-SU-2026:24271-1","SUSE-SU-2026:4843-1","SUSE-SU-2026:4844-1","SUSE-SU-2026:4852-1","SUSE-SU-2026:4853-1","SUSE-SU-2026:4870-1","openSUSE-SU-2026:12219-1","openSUSE-SU-2026:22151-1"],"database_specific":{"cna_assigner":"php","cwe_ids":["CWE-1325","CWE-1419","CWE-416","CWE-755","CWE-824"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109619.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/21/16"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/21/17"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/21/23"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/21/7"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/22/14"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/22/15"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/22/16"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/22/19"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/22/2"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/22/20"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/23/4"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-166980.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-566435.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-566512.html"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619"},{"type":"ADVISORY","url":"https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109619.json"},{"type":"ADVISORY","url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109619"},{"type":"ADVISORY","url":"https://php2shell.delftintellab.com/"},{"type":"ADVISORY","url":"https://www.wiz.io/blog/php2shell-php-rce"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/php/php-src","events":[{"introduced":"76b580d87afcbdd170853194ffcb80cee45894bd"},{"fixed":"09a9f29a0402bb87bb448cb2e3149ccbec1699c6"},{"introduced":"d26068059e83fe40de3430a512471d194119bee0"},{"fixed":"5ba6ad519229ac09fc4fc74155c76bdca69ae0de"},{"introduced":"b437f2b32eb364c9496d24abcc734272e5c9c980"},{"fixed":"00d8bae801541db0d95a698e108bb4b1b273fe6e"},{"introduced":"685e99655ae97c667950f7f7d176985958718f56"},{"fixed":"136e049ac10b032c83018e65b63b6df858943750"}],"database_specific":{"extracted_events":[{"source":"CPE_RANGE","cpe":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","range":[{"introduced":"5.4.0"},{"fixed":"8.2.35"}]},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","range":[{"introduced":"8.3.0"},{"fixed":"8.3.36"}]},{"range":[{"introduced":"8.4.0"},{"fixed":"8.4.27"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","range":[{"introduced":"8.5.0"},{"fixed":"8.5.12"}]}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109619.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}