CVE-2026-109619

Status: ModifiedCritical (9.2)—PoC

Severity9.2Critical · CVSS 4.0

Exploitation probability—next 30 days

Active exploitationNonot in the CISA catalog

Public exploitAvailableProof of concept on GitHub (unverified)

News and reports on Orbitaley

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CVSS

Base score: 9.2
Version: 4.0
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploitation probability (EPSS)

FIRST hasn't scored this CVE yet (usual for very recent or rejected CVEs).

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Proof of concept on GitHub (unverified) · List of proofs of concept on GitHub

⚠️ GitHub proofs of concept are not verified: some are fake or contain malware. Never run them outside an isolated lab.

Media coverage

Specialised security media that have cited this CVE:

Dailysecu · 티오리, 치명적 PHP 취약점 ‘PHP2Shell’ 재현·검증 완료…긴급 대응 방안 공개 (10/22/2026)
Dailysecu · “전 세계 2,200만 PHP 인스턴스 노출…국내 기업 보안 대응 시급” (10/22/2026)
Bitlifemedia · Detectan dos fallos críticos de seguridad en PHP que afectan a millones de páginas web (10/22/2026)
Orbitaley · php2shell: dos fallos en el núcleo de PHP obligan a parchear a toda prisa y apagan webs públicas en media Europa (10/22/2026)
UnderNews · Deux failles critiques affectant PHP (10/22/2026)
Borns IT- und Windows-Blog · php2shell: PHP-Updates und Nachlese (10/22/2026)
JPCERT/CC (日本語) · 注意喚起: PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619）に関する注意喚起 (公開) (10/22/2026)
Ciberseguridad LATAM · PHP2Shell: dos fallas críticas en el núcleo de PHP explotadas antes de su divulgación pública (10/22/2026)
JVN · PHPにおける複数の任意のコードが実行可能な脆弱性（CVE-2026-109618、CVE-2026-109619） (10/22/2026)
Zscaler ThreatLabz · CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks (10/21/2026)
Dailysecu · [긴급] PHP ‘PHP2Shell’ 치명적 취약점 2건…인증 없이 원격 코드 실행 위험 (10/21/2026)
CISO Advisor · PHP2Shell: correções chegam com primeiras explorações (10/21/2026)

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access90 %
Primary impactT1059 Command and Scripting Interpreterexecution80 %

El vector AV:N/PR:N/UI:N indica explotación remota sin privilegios ni interacción (T1190); la descripción señala ejecución remota de código (RCE) en PHP, código no atado a un intérprete concreto (T1059).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Privileged Account Management Vulnerability Scanning Restrict Web-Based Content Network Segmentation Limit Software Installation Limit Access to Resource Over Network

Affected technologies (1)

PHP — PHP

CWEs

CWE-416, CWE-755, CWE-824, CWE-1325

References

Show 7 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-109619",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-109619",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-21T14:34:42.468059Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@php.net",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.2,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@php.net",
      "affectedData": [
        {
          "vendor": "PHP Group",
          "product": "PHP",
          "versions": [
            {
              "status": "affected",
              "version": "8.2.*",
              "lessThan": "8.2.35",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "8.3.*",
              "lessThan": "8.3.36",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "8.4.*",
              "lessThan": "8.4.27",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "8.5.*",
              "lessThan": "8.5.12",
              "versionType": "semver"
            }
          ],
          "packageName": "php-src",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-21T14:17:09.823",
  "references": [
    {
      "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security@php.net"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/21/16",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/21/17",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/21/23",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/21/7",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/22/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.wiz.io/blog/php2shell-php-rce",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@php.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        },
        {
          "lang": "en",
          "value": "CWE-755"
        },
        {
          "lang": "en",
          "value": "CWE-824"
        },
        {
          "lang": "en",
          "value": "CWE-1325"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
    },
    {
      "lang": "es",
      "value": "PHP cuenta con varios estados globales que apuntan temporalmente a la memoria de la solicitud. En algunos casos, es posible que estos estados globales no se restablezcan correctamente o que se vuelvan a rellenar tras su restablecimiento. En tal caso, el estado global podría seguir haciendo referencia a la memoria de la solicitud incluso después de que esta haya sido liberada. Las solicitudes posteriores podrían leer o tomar decisiones basadas en este estado obsoleto antes de que se haya inicializado por completo. Existen varias estrategias que pueden desencadenar esta situación y dar lugar a la ejecución remota de código (RCE)."
    }
  ],
  "lastModified": "2026-10-22T10:09:59.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80F659BB-0C5C-4F1B-8323-AE52F32C3BE4",
              "versionEndExcluding": "8.2.35"
            },
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40BD58D9-94BD-41B6-9DDA-30CA729409FB",
              "versionEndExcluding": "8.3.36",
              "versionStartIncluding": "8.3.0"
            },
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D057202A-94FF-4118-A41F-BA8ABB76346E",
              "versionEndExcluding": "8.4.27",
              "versionStartIncluding": "8.4.0"
            },
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAF7FA75-7F87-405F-A222-C5C17D42C31F",
              "versionEndExcluding": "8.5.12",
              "versionStartIncluding": "8.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@php.net"
}