Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

highVulnerabilityimportance 42CVE-2026-109619

AI summary

Posted by Aaron Rainbolt on Oct 21 While not yet fully confirmed, the Fediverse is reporting that the fix https://fedi.katze.sh/@elise/117479383739450605

Read the original

Tags#cve-2026-109619 #vulnerability

Vulnerabilities mentionedAll →

CVE-2026-1096199.26%
PHP has various global state that temporarily points into request memory
published 1d ago· php php PoC ×7

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-109619	PHP has various global state that temporarily points into request memory

Full article

Posted by Aaron Rainbolt on Oct 21 While not yet fully confirmed, the Fediverse is reporting that the fix https://fedi.katze.sh/@elise/117479383739450605

This source does not provide full text. Read it at seclists.org.

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Vulnerabilities mentionedAll →

PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

PHP ships emergency patches for critical PHP2Shell flaws

Hundreds of websites taken offline as concern grows over two PHP vulnerabilities

‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

PHP Releases Emergency Patches for PHP2Shell Flaws Threatening Millions of Web Servers

CVE-2026-109618 / CVE-2026-109619 | PHP Core Remote Code Execution Vulnerabilities (PHP2Shell)

PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched

CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption

Two critical RCEs in PHP core

CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Widespread PHP Flaw May Cause Many Site Outages Today

USN-8948-2: PHP vulnerabilities

Today's PHP Security Release, and How We're Strengthening PHP Security

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

PHP2Shell: Why websites are going offline for emergency security updates

PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024

AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619

Gcore Makes Enterprise Security Bundle Free for Public Agencies Until End of the Year

Gcore Makes Enterprise Security Bundle Free for Public Agencies Until End of the Year

PHP2Shell puts dozens of UK government services out of service

PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports

Hackers Were Targeting Critical PHP Vulnerabilities Days Before They Were Patched

Understanding PHP2Shell: Everything You Need to Knownew

New Serious PHP Vulnerabilities Released and Patched

Amazon says PHP2Shell exploitation began 4 days before patches