Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

[Emmanuel Fleury <emmanuel.fleury () u-bordeaux fr>]

On 10/22/26 10:49, Emmanuel Fleury wrote:
> Yes, CVE-2026-109618 and CVE-2026-109619 have been found together but seems to 
> be two different vulnerabilities (even if they are sharing a lot).
>
> Here is a technical description of the bugs and the finding process:
>
> https://calif.io/php2shell/

Hint: skip the comics part (useless) and go directly to the written part at the end.

Regards
--
Emmanuel Fleury

Univ. de Bordeaux, LaBRI,   | Associate Professor,
351, Cours de la Libération | Email: emmanuel.fleury () u-bordeaux fr
33405 Talence Cedex, France | Web: http://www.labri.fr/~fleury