[ CVE-2026-109619 · Published 21 Oct 2026 ]
Stale memory references in PHP can lead to remote code execution
[ Why it matters ]Priority signals
- Urgent advisory from BSI, CERT-EU, CERT-FR, NCSC-NL, NCSC-UK
- Interim mitigation published by PrivacySafe
[ Analyst view ]Is this a red alert for you?
Patch within days
It is reachable over the network without credentials, but the attack is complex and our sources do not report exploitation yet.
- Red alert if
- Exploitation is reported for this flaw, or you run public PHP applications on an affected version that you cannot patch this week.
- Can wait if
- You do not run PHP, or your PHP 8.x is already on the fixed release.
- What it is
- Some of PHP's global state can keep pointing at request memory after it has been freed, and later requests may act on that stale state. Several ways of triggering this can produce remote code execution. PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12 are affected.
- Impact
- A remote attacker without an account could run code on a server that runs PHP, although the attack is harder to pull off than CVE-2026-109618. A compromise would expose the website or application, the data it holds and the credentials in its configuration.
How an attack would work MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationThe attacker sends sequences of requests to a public PHP application to trigger the stale state.
- T1059 Command and Scripting InterpreterMemory corruption is turned into code running as the web server user.
- T1505.003 Server Software Component: Web ShellA web shell keeps access to the compromised server.
- T1552 Unsecured CredentialsDatabase passwords and API keys in the application's configuration are read.
What to do
- Upgrade PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later; the same upgrade fixes CVE-2026-109618.
- Restart PHP-FPM or the web server so the new version is running.
- On Debian or Ubuntu with PHP-FPM, use the PrivacySafe PHP2Shell interim mitigation only if you cannot upgrade yet.
- Ask your hosting provider to confirm the fixed version for shared or managed hosting.
[ Description ]Official description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
[ Fixes ]Fixes and patches
- PHP2ShellInterim mitigation · PrivacySafe · Interim mitigation for PHP-FPM 7.0 through 8.5 on Debian/Ubuntu/Trisquel and derivatives
- Security bulletin: PHPVendor patch or bulletin · CERT-FR · php.net/index.php, cited by CERT-FR CERTFR-2026-AVI-1359
- Statement by PHPVendor patch or bulletin · CERT-FR · php.net/archive/2026.php, cited by CERT-FR CERTFR-2026-ALE-014
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1360
Multiple vulnerabilities in Cisco products Translated from French
Multiple vulnerabilities have been discovered in Cisco products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
-
CERT-EUCERT-EU 2026-018
Critical Vulnerabilities in PHP
On 20 October 2026, the PHP project announced an upcoming security release addressing two critical vulnerabilities in PHP. Public reports indicated that these vulnerabilities could lead to remote code execution. The PHP…
-
NCSC-NLNCSC-2026-0443
Vulnerabilities fixed in PHP Translated from Dutch
-
NCSC-UK
Critical security issue affecting PHP
Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
-
CERT-FRCERTFR-2026-AVI-1359
Multiple vulnerabilities in PHP Translated from French
Multiple vulnerabilities have been discovered in PHP. They allow an attacker to cause remote arbitrary code execution.
-
CERT-FRCERTFR-2026-ALE-014
[Update] Multiple vulnerabilities in PHP Translated from French
[Update of 22 October 2026] CERT-FR is aware of proofs of concept for vulnerabilities CVE-2026-109618 and CVE-2026-109619 for specific PHP deployments. [Update of 21 October 2026] The security patches are available on…
-
BSI CERT-BundWID-SEC-2026-4055
PHP: Multiple vulnerabilities allow code execution Translated from German
[ References ]References
- github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rpMitigationVendor Advisory
- www.openwall.com/lists/oss-security/2026/10/21/16Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2026/10/21/17Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2026/10/21/23Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2026/10/21/7Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2026/10/22/14
- www.openwall.com/lists/oss-security/2026/10/22/15
- www.openwall.com/lists/oss-security/2026/10/22/16
- www.openwall.com/lists/oss-security/2026/10/22/19
- www.openwall.com/lists/oss-security/2026/10/22/2Mailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2026/10/22/20
- www.wiz.io/blog/php2shell-php-rceThird Party Advisory