CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
Posted by Jakub Zelenka on Oct 21 Hello, The PHP security team announces a critical vulnerability in PHP core (php-src). CVE: CVE-2026-109619 Severity: Critical (CVSS v4.0: 9.2) Affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27, and PHP 8.5 before 8.5.12. PHP maintains global state that temporarily points into request memory. In some scenarios, this state…
Vulnerabilities mentionedAll →
- CVE-2026-1096199.26%PHP has various global state that temporarily points into request memorypublished · php php PoC ×7
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-109619 | PHP has various global state that temporarily points into request memory |
Posted by Jakub Zelenka on Oct 21 Hello, The PHP security team announces a critical vulnerability in PHP core (php-src). CVE: CVE-2026-109619 Severity: Critical (CVSS v4.0: 9.2) Affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27, and PHP 8.5 before 8.5.12. PHP maintains global state that temporarily points into request memory. In some scenarios, this state is not correctly reset, or is repopulated after being reset. Once the request...
This source does not provide full text. Read it at seclists.org.
Akamai Blog