Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

CISA KEV lists PHP request-state flaw enabling unauthenticated RCE

Original title: CISA KEV: PHP Stale Internal Request-State Vulnerability — PHP Group PHP (CVE-2026-109619)

CISA Known Exploited Vulnerabilities ()1 min read1
Read at cisa.gov
Part of a story covered by 21 sourcesCISA lists exploited PHP2Shell flaws; agencies must patch by Oct. 29Merged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

CVE-2026-109619 is a stale internal request-state bug; the federal remediation due date is October 29.

CISA added CVE-2026-109619 to the Known Exploited Vulnerabilities catalog. PHP Group PHP has a stale internal request-state vulnerability that allows unauthenticated remote code execution. Stakeholders must apply vendor mitigations consistent with BOD 26-04, or discontinue the product if mitigations are unavailable. The due date is October 29, 2026. Known ransomware campaign use is unknown.

Unconfirmed: CISA lists known ransomware campaign use as unknown.

Key facts
  • Unauthenticated remote code execution from stale request state.
  • KEV due date is October 29, 2026.
  • Known ransomware campaign use is unknown.
  • Follow BOD 26-04 or stop using the product.
Security assessment · AI, from the articleExploited in the wild

Impact: Unauthenticated remote code execution

ProductAffected
PHP Group PHP—
What to do
  1. 1.Apply mitigations per vendor instructions and CISA BOD 26-04.
  2. 2.Discontinue use if mitigations are unavailable.
  3. 3.Evaluate internet exposure and meet the October 29, 2026 due date.
Analyze CVE-2026-109619 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-109619
ATT&CK
T1190 Exploit Public-Facing Application
Tags
phpcisa-kevremote-code-executionrequest-state
Vendors
PHP Group
Products
PHP
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109619
Use-after-free RCE in PHP via stale request globals
9.2100%KEVPoC ×15
KEV

From the original article

1 min read at cisa.gov

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.