Part of a story covered by 21 sources: “PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports” — merged summary and timeline →
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
AI summary
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
Posted by Nicolas Vigier on Oct 22 https://codeberg.org/oerdnj/deb.sury.org/issues/145#issuecomment-26090654 "The PHP team is aware of that report and there are no new plans as of now."
Vulnerabilities mentionedAll →
- CVE-2026-1096199.26%PHP has various global state that temporarily points into request memorypublished · php php PoC ×9
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-109619 | PHP has various global state that temporarily points into request memory |
Full article
Posted by Nicolas Vigier on Oct 22 https://codeberg.org/oerdnj/deb.sury.org/issues/145#issuecomment-26090654 "The PHP team is aware of that report and there are no new plans as of now."
This source does not provide full text. Read it at seclists.org.
Hacker News · security