PHP has various global state that temporarily points into request memory
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
* Cloud Computing
* [AI and API Manager](https://www.akamai.com/solutions/ai-and-api-manager)
* [Serverless](https://www.akamai.com/solutions/serverless)
* [Media](https://www.akamai.com/solutions/media)
* [SaaS](https://www.akamai.com/solutions/saas)
* [See all Cloud Computing](https://www.akamai.com/cloud)
* security
* [Frontier AI Security Risks](https://www.akamai.com/solutions/frontier-ai-security-risks)
* [AI Security](https://www.akamai.com/solutions/ai-security)
* [Akamai Application Protection Platform](https://www.akamai.com/solutions/akamai-application-protection-platform)
* [Cybersecurity Compliance](https://www.akamai.com/solutions/cybersecurity-compliance)
* [Ransomware Protection](https://www.akamai.com/solutions/ransomware-protection)
* [Secure Apps and APIs](https://www.akamai.com/solutions/app-and-api-security)
* [DNS Delivery and Security](https://www.akamai.com/solutions/dns-delivery-and-security)
* [Zero Trust](https://www.akamai.com/solutions/zero-trust-security)
* [DDoS Protection](https://www.akamai.com/solutions/ddos-protection)
* [Bot & Agent Control](https://www.akamai.com/solutions/bot-and-agent-control)
* [Identity, Credential and Access Management](https://www.akamai.com/solutions/identity-credential-and-access-management)
* [See all Cybersecurity](https://www.akamai.com/security)
* content delivery
* [App and API Performance](https://www.akamai.com/content-delivery-network/app-and-api-performance)
* [Media Delivery](https://www.akamai.com/content-delivery-network/media-delivery)
* [See all Content Delivery](https://www.akamai.com/content-delivery-network)
* industry solutions
* [Media and Entertainment](https://www.akamai.com/solutions/industries/media)
* [Retail, Travel, and Hospitality](https://www.akamai.com/solutions/industries/retail-travel-hospitality)
* [Financial Services](https://www.akamai.com/solutions/industries/financial-services)
* [Healthcare and Life Sciences](https://www.akamai.com/solutions/industries/health-care-life-sciences)
* [Public Sector](https://www.akamai.com/solutions/industries/public-sector)
* [Defense](https://www.akamai.com/solutions/industries/defense-and-intelligence)
* [Games](https://www.akamai.com/solutions/industries/games)
* [Online Sports Betting and iGaming](https://www.akamai.com/solutions/industries/online-sports-betting)
* [Service Providers](https://www.akamai.com/solutions/industries/service-providers)
* [See all Industry Solutions](https://www.akamai.com/solutions/industries)
* Pricing
Back Pricing Close
Security and Delivery
* Get started
* [Contact Sales](https://www.akamai.com/why-akamai/contact-us/contact-sales)
* [Free trials](https://www.akamai.com/products#free-trials)
The patches are available immediately and users are urged to upgrade to fixed releases as soon as possible.
Mitigation with Akamai App & API Protector
Akamai App & API Protector customers are protected because we have released security updates to address this CVE and monitor for exploitation attempts.
Based on our investigation, Akamai App & API Protector is mitigating weaponized payloads with existing command injection rules.
The most effective defense continues to be the prompt application of vendor patches. For organizations that cannot patch immediately, applying web application firewall rules is critical to block attack attempts.
Stay tuned
The Akamai Security Intelligence Group will continue to monitor, report on, and create mitigations for threats such as these for both our customers and the security community at large. To keep up with more breaking news from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.
Akamai SIG is a global team of world-class researchers, engineers, strategists, and data scientists with a broad range of expertise and security disciplines. Our data sources include the enormous Akamai Cloud, open sources, collaboration with third parties, and dark web intelligence. We have also developed our own algorithms and tools that help us deliver our research and keep Akamai security solutions up to date.
Read about CVE-2026-21589, a critical arbitrary file read vulnerability affecting multiple Atlassian Data Center products. Akamai customers are protected.
Learn how Akamai’s ExAR capabilities helped contain a complex supply chain intrusion targeting Linux, OpenShift, and Windows DMZ workloads in Latin America.
Akamai Blog
