CVE-2026-109619
PHP has various global state that temporarily points into request memory.
- Severity
- 9.2 / 10
- Critical · CVSS 4.0
- Exploit chance (EPSS)
- 100.00%
- Chance of exploitation in the next 30 days. Higher than 100.00% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Oct 26, 2026
- Weakness
- CWE-416 Use After Free
- CWE-755 Improper Handling of Exceptional Conditions
- CWE-824 Access of Uninitialized Pointer
- CWE-1325 Improperly Controlled Sequential Memory Allocation
- Fix
- None yet
- No fixed version published
Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 9.2
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Not defined
- Scope
- X
CVSS 3.1 8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it
- Architecture and Design: Choose a language that provides automatic memory management.
- Implementation: When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
CWE-755: Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
CWE-824: Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
CWE-1325: Improperly Controlled Sequential Memory Allocation
The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
How to prevent it
- Implementation: Ensure multiple allocations of the same kind of object are properly tracked - possibly across multiple sessions, requests, or messages. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
- Operation: Run the program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.
References
Advisories
- github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- openwall.com/lists/oss-security/2026/10/21/16
- openwall.com/lists/oss-security/2026/10/21/17
- openwall.com/lists/oss-security/2026/10/21/23
- openwall.com/lists/oss-security/2026/10/21/7
- openwall.com/lists/oss-security/2026/10/22/14
- openwall.com/lists/oss-security/2026/10/22/15
- openwall.com/lists/oss-security/2026/10/22/16
- openwall.com/lists/oss-security/2026/10/22/19
- openwall.com/lists/oss-security/2026/10/22/2
- openwall.com/lists/oss-security/2026/10/22/20
- openwall.com/lists/oss-security/2026/10/23/4
- arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthe…
- cert-portal.siemens.com/productcert/html/ssa-566512.html
- php2shell.delftintellab.com
- wiz.io/blog/php2shell-php-rce
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. | Critical Known exploited | Same weakness, CWE-416 |
| GHSA-7mwm-ghpf-9vrm Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform | High | Same weakness, CWE-416 |
| GHSA-4rr5-89j8-mwwm Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer | High | Same weakness, CWE-416 |
| GHSA-wq5f-xc86-pv6w sharp : Vulnerability in librsvg dependency CVE-2026-96889 | High | Same weakness, CWE-416 |
| RUSTSEC-2026-0326 Rooting for GC values live across `try_call` may be missing, causing GC heap corruption | Medium | Same weakness, CWE-416 |
| CVE-2026-68820 Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | High Known exploited | Same weakness, CWE-416 |
| GHSA-c494-m2fq-59mx Microsoft Security Advisory CVE-2026-62898 – .NET Information Disclosure Vulnerability | High | Same weakness, CWE-416 |
| GHSA-9hj4-r449-hfvc Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams | High | Same weakness, CWE-416 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor