Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

[Jakub Zelenka <bukka () php net>]

Hi,

On Wed, Oct 21, 2026 at 5:40 PM Aaron Rainbolt <arraybolt3 () gmail com> wrote:

> On Wed, Oct 21, 2026 at 10:11 AM Jakub Zelenka <bukka () php net> wrote:
> > Hello,
> >
> > The PHP security team announces a critical vulnerability in PHP core
> > (php-src).
> >
> > CVE: CVE-2026-109619
> > Severity: Critical (CVSS v4.0: 9.2)
> >
> > Affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP
> 8.4
> > before 8.4.27, and PHP 8.5 before 8.5.12.
> >
> > PHP maintains global state that temporarily points into request memory.
> In
> > some scenarios, this state is not correctly reset, or is repopulated
> after
> > being reset. Once the request memory is freed, a subsequent request
> handled
> > by the same worker may access the stale state before normal
> initialization
> > replaces it, causing a use-after-free and potentially allowing remote
> code
> > execution.
> >
> > Unauthenticated RCE has been demonstrated against Apache mod_php and
> > PHP-FPM. Exploitability depends on the affected state, configuration, and
> > application behavior.
> >
> > Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or a later release in
> the
> > corresponding branch. Updating is the only reliable mitigation; there is
> no
> > complete generic configuration workaround.
>
> While not yet fully confirmed, the Fediverse is reporting that the fix
> to at least PHP 8.5.12 may be incomplete:
> https://fedi.katze.sh/@elise/117479383739450605
This is unrelated issue with minimal impact (crash in one component in
slightly unlikely scenario). It has nothing to do with the RCE.

Kind regards,

Jakub