CVE-2026-109619: RCE via stale global state
High · CVSS 8.1 (CVSS 3.1)EPSS 100.0%, 100th percentilePublished Updated Assigner: php
Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-1325, CWE-1419, CWE-416, CWE-755, CWE-824
Tracked companies
Amazon Web ServicesGoogle Cloud
Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.
Status incidents that name it
- · No impact listed · says not affected (notice says “no impact to ”)
“PHP2Shell (CVE-2026-109618, CVE-2026-109619) Status: No impact identified; review ongoing We have found no impact to Notion from PHP2Shell. Notion's services do…”
- · No impact listed · says not affected (notice says “not impacted”)
“…has confirmed that no first-party Amplitude services are impacted by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell Advisory). We are working with an affected third-party vendor to establish security updates on their end;…”
- · No impact listed · says not affected (notice says “Not Affected”)
“…Advisory: Astro and Astro Private Cloud Not Affected; Review Custom Images PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Astronomer has conducted a thorough internal review of its code and container images and confirmed that Astro and…”
- Scaleway [Serverless Functions][fr-par/nl-ams/pl-waw] Security updates applied to PHP and Node.js runtimes· Minor · names this CVE
“…the PHP and Node.js runtimes used by Serverless Functions. --- PHP Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35,…”
- · No impact listed · says not affected (notice says “no impact on ”)
“Zapier services or customer data. This advisory is now closed. Security FAQ: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) "1. What is this issue? Two vulnerabilities were disclosed in PHP, an open-source programming language. Both can…”
- · Minor · names this CVE
“…If an image in your registry still doesn't have a fixed version, contact Support. Next update by October 23, 16:00…”
- Cloudinary Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619· No impact listed · says not affected (notice says “not affected”)
“Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Regarding the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Cloudinary’s core platform, including its…”
- · No impact listed · names this CVE
“Execution Vulnerabilities We can confirm that remediation efforts for the reported vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were completed as of 20:06 UTC on October 23, 2026.We have found no evidence that these vulnerabilities impacted…”
- · No impact listed · names this CVE
“…has completed its assessment of the recently published PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) across our platform and infrastructure, and mitigation efforts are complete. Cloud Infrastructure Speed Tests will…”
- · Maintenance · names this CVE
“…today a fix for two critical vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5 As a precaution, we…”
- · Critical · names this CVE
“…today a fix for two critical vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5 As a precaution, we…”
- · Maintenance · says not affected (notice says “unaffected”)
“…PHP vulnerabilities - customer action may be required Aptible is aware of the vulnerabilities CVE-2026-109618 and CVE-2026-109619 affecting PHP applications that can allow for remote code execution under certain conditions. *Aptible Platform…”
- · Minor · names this CVE
“PHP security issues CVE-2026-109618 and CVE-2026-109619 We deployed patches for the remaining PHP versions 5.6 and 7.3 on all Webhosting- and Managed-Servers. We deployed…”
- · Minor · names this CVE
“…Public API As part of our emergency mitigation for the recently discovered PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), the Pingdom API now requires requests to include a User-Agent header. Please update your integration to include a…”
Affected vendors and products
PHP Group: PHPSiemens: RUGGEDCOM APE1808
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)