Vulnerability Intelligence Report
RCE via stale global state
CVE-2026-109619
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
CISA KEV
CVSS Base Score
9.2
CRITICAL
EPSS Probability:100.00%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-416 ↗CWE-416 Use after free
CWE-755 ↗CWE-755 Improper Handling of Exceptional Conditions
CWE-824 ↗CWE-824 Access of uninitialized pointer
CWE-1325 ↗CWE-1325 Improperly controlled sequential memory allocation
CWE-1419 ↗CWE-1419 Incorrect Initialization of Resource
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| PHP Group | PHP | 8.2.* < 8.2.35 (affected), 8.3.* < 8.3.36 (affected), 8.4.* < 8.4.27 (affected), 8.5.* < 8.5.12 (affected) |
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
EPSS Score
99.997%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | PHP Group · Vendor · USA |
| Reserved | 2026-10-12T21:04:00 |
| Published | 2026-10-21T13:54:43 |
| Last Updated | 2026-10-27T03:55:26 |
Community Chatter & Buzz