PHP 8.2–8.5 stale-state RCE cited again (CVE-2026-109619)
Original title: Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
The follow-up only links CrowdStrike's blog and gives no patch or attack details.
Christian Fischer sent a short oss-security follow-up about CVE-2026-109619 on October 23. It points to the same CrowdStrike blog about PHP remote-code-execution zero-days and contains no further analysis. The subject describes remote code execution through stale global state in PHP 8.2–8.5.
Unconfirmed: The mailing-list post itself does not establish that the flaw is exploited.
- The body is only a reference link and a greeting.
- No affected build beyond PHP 8.2–8.5 is listed.
- No remediation appears in the message.
Impact: remote code execution, as claimed in the subject
| Product | Affected |
|---|---|
| PHP | 8.2–8.5 |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-109619 | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
From the original article
Posted by Christian Fischer on Oct 23 Just as an follow-up to an earlier mail on this: https://www. crowdstrike. com/en-us/blog/crowdstrike-protects-customers-from-php-rce-zero-days/ Regards
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.