Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

["Goetz T. Fischer" <g.fischer () r-a-c de>]

On Thu, 22 Oct 2026 08:45:47 +0200, Christian Fischer wrote:
> it might worth to mention that the subject as well as the text here
> could imply / be interpreted that only PHP 8.2-8.5 are affected (and
> older versions not).
>
> But at least https://www.php.net/archive/2026.php#2026-10-21-5 mentions
> the availability for backports down to PHP 7.4 which implies that at
> least versions down to 7.4 are affected as well:

affected is 5.4.0 and all newer ones.

--
R-A-C
Götz T. Fischer CertIT&Comp
+49(0)7225/98 98 79
g.fischer () r-a-c de
r-a-c.de