Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109619— RCE via stale global state

Quick assessment

Affected
PHP Group PHP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PHP 中存在多种全局状态，这些状态会暂时指向请求内存。在某些场景下，全局状态可能未被正确重置，或在重置后又被重新填充。这会导致全局状态在请求内存已被释放后，仍然引用该内存。后续请求可能在全局状态完全初始化之前，读取或基于这些陈旧状态进行分支判断。多种触发策略可引发此条件，进而导致远程代码执行（RCE）。

CVSS 9.2 · Critical

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 4

VendorProduct Version RangeStatus
PHP Group PHP 8.2.*< 8.2.35 affected
8.3.*< 8.3.36 affected
8.4.*< 8.4.27 affected
8.5.*< 8.5.12 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109619

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RCE via stale global state
Source: CVE Program / CVE List V5
Vulnerability Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
PHP Group PHP 8.2.* ~ 8.2.35 -

II. Public POCs for CVE-2026-109619

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109619

请登录查看更多情报信息。

Other References for CVE-2026-109619 (1)

IV. Related Vulnerabilities

Same product: PHP
Same vendor: PHP Group
Same weakness: CWE-416

V. Comments for CVE-2026-109619

No comments yet

Leave a comment