# CVE-2026-109619: RCE via stale global state

> CVE-2026-109619: RCE via stale global state. CVSS 8.1 (CVSS 3.1), named in 14 status incident(s).

Canonical: https://rewindex.com/cve/CVE-2026-109619
Last updated: 2026-10-23T16:06:48Z

- Published: 2026-10-21 13:54 UTC · Updated: 2026-10-23 16:06 UTC · Assigner: php
- CVSS: 8.1 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS: 100.0%, 100th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-1325, CWE-1419, CWE-416, CWE-755, CWE-824

## Description

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

## Affected vendors and products

- PHP Group: PHP
- Siemens: RUGGEDCOM APE1808

## Tracked companies

- [Amazon Web Services](https://rewindex.com/company/aws.md)
- [Google Cloud](https://rewindex.com/company/google-cloud.md)

## Status incidents that name it

- 2026-10-23 00:14 UTC [Notion: PHP2Shell (CVE-2026-109618, CVE-2026-109619)](https://rewindex.com/company/notion/incidents/01M5K1RNRANQ1YWEAF2W6R0N51.md) (says not affected, matched “no impact to” elsewhere in the notice): “PHP2Shell (CVE-2026-109618, CVE-2026-109619) Status: No impact identified; review ongoing We have found no impact to Notion from PHP2Shell. Notion's services do…”
- 2026-10-22 19:25 UTC [Amplitude: Notice: Amplitude not impacted by recent PHP vulnerabilities](https://rewindex.com/company/amplitude/incidents/1nhs3z82vtvl.md) (says not affected, matched “not impacted” elsewhere in the notice): “…has confirmed that no first-party Amplitude services are impacted by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell Advisory). We are working with an affected third-party vendor to establish security updates on their end;…”
- 2026-10-22 18:26 UTC [Astronomer: PHP Security Advisory: Astro and Astro Private Cloud Not Affected; Review Custom Images](https://rewindex.com/company/astronomer/incidents/01M5JDSVJXDAN1PQYRMY5CHP50.md) (says not affected, matched “Not Affected” elsewhere in the notice): “…Advisory: Astro and Astro Private Cloud Not Affected; Review Custom Images PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) Astronomer has conducted a thorough internal review of its code and container images and confirmed that Astro and…”
- 2026-10-22 15:18 UTC [Scaleway: \[Serverless Functions\]\[fr-par/nl-ams/pl-waw\] Security updates applied to PHP and Node.js runtimes](https://rewindex.com/company/scaleway/incidents/wn4wy3l5mhkq.md) (names this CVE): “…the PHP and Node.js runtimes used by Serverless Functions. --- PHP Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35,…”
- 2026-10-22 14:02 UTC [Zapier: Assessment of recently reported PHP vulnerabilities](https://rewindex.com/company/zapier/incidents/01M5HYPNNVAQQPNWSF691PS7XK.md) (says not affected, matched “no impact on” elsewhere in the notice): “Zapier services or customer data. This advisory is now closed. Security FAQ: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619) "1. What is this issue? Two vulnerabilities were disclosed in PHP, an open-source programming language. Both can…”
- 2026-10-21 22:08 UTC [Chainguard: Critical PHP vulnerabilities require updates](https://rewindex.com/company/chainguard/incidents/1098100.md) (names this CVE): “…If an image in your registry still doesn't have a fixed version, contact Support. Next update by October 23, 16:00…”
- 2026-10-21 18:22 UTC [Cloudinary: Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619](https://rewindex.com/company/cloudinary/incidents/fnwd86wg4608.md) (says not affected, matched “not affected” elsewhere in the notice): “Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Regarding the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Cloudinary’s core platform, including its…”
- 2026-10-21 15:03 UTC [Akamai: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities](https://rewindex.com/company/akamai/incidents/3074yp9cpd8h.md) (names this CVE): “Execution Vulnerabilities We can confirm that remediation efforts for the reported vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were completed as of 20:06 UTC on October 23, 2026.We have found no evidence that these vulnerabilities impacted…”
- 2026-10-21 14:44 UTC [Linode (Akamai): Customer Security Advisory: PHP Remote Code Execution Vulnerabilities](https://rewindex.com/company/linode-akamai/incidents/wq8zlhk736fk.md) (names this CVE): “…has completed its assessment of the recently published PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) across our platform and infrastructure, and mitigation efforts are complete. Cloud Infrastructure Speed Tests will…”
- 2026-10-21 14:38 UTC [Scaleway: P2 - \[WEBHOSTING\] - PHP Emergency maintenance](https://rewindex.com/company/scaleway/incidents/t6t2jbytc4gt.md) (names this CVE): “…today a fix for two critical vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php\#2026-10-21-5 As a precaution, we…”
- 2026-10-21 14:06 UTC [Scaleway: \[BookMyName\]\[Security\] Emergency maintenance - BMN services unavailable](https://rewindex.com/company/scaleway/incidents/k8yyg32ksqcy.md) (names this CVE): “…today a fix for two critical vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php\#2026-10-21-5 As a precaution, we…”
- 2026-10-21 13:04 UTC [Aptible: Critical PHP vulnerabilities - customer action may be required](https://rewindex.com/company/aptible/incidents/kj6v558f61bh.md) (says not affected, matched “unaffected” elsewhere in the notice): “…PHP vulnerabilities - customer action may be required Aptible is aware of the vulnerabilities CVE-2026-109618 and CVE-2026-109619 affecting PHP applications that can allow for remote code execution under certain conditions. \*Aptible Platform…”
- 2026-10-21 11:04 UTC [Hetzner: PHP security issues CVE-2026-109618 and CVE-2026-109619](https://rewindex.com/company/hetzner/incidents/f4144d55-38c3-48d1-8664-7a3429355cd7.md) (names this CVE): “PHP security issues CVE-2026-109618 and CVE-2026-109619 We deployed patches for the remaining PHP versions 5.6 and 7.3 on all Webhosting- and Managed-Servers. We deployed…”
- 2026-10-20 06:30 UTC [Pingdom: Emergency Changes to the Pingdom Public API](https://rewindex.com/company/pingdom/incidents/512230.md) (names this CVE): “…Public API As part of our emergency mitigation for the recently discovered PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), the Pingdom API now requires requests to include a User-Agent header. Please update your integration to include a…”

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-109619)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-109619)
- [https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-109619 · Markdown: https://rewindex.com/cve/CVE-2026-109619.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-109619 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:19.960Z