Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
Posted by Aaron Rainbolt on Oct 21 ...snip... According to a conversation in #security:ubuntu.com Matrix, Canonical asked php.org if the issue mentioned in this Mastodon thread was a real vulnerability or not, and was told that it's "unrelated and not a real issue". If someone from the PHP security team could reconfirm this here, that would be greatly appreciated.
Vulnerabilities mentionedAll →
- CVE-2026-1096199.26%PHP has various global state that temporarily points into request memorypublished · php php PoC ×7
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-109619 | PHP has various global state that temporarily points into request memory |
Posted by Aaron Rainbolt on Oct 21 ...snip... According to a conversation in #security:ubuntu.com Matrix, Canonical asked php.org if the issue mentioned in this Mastodon thread was a real vulnerability or not, and was told that it's "unrelated and not a real issue". If someone from the PHP security team could reconfirm this here, that would be greatly appreciated.
This source does not provide full text. Read it at seclists.org.
Akamai Blog