What’s Vulnerable › Vulnerabilities

CVE-2026-109619: RCE via stale global state

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-10-26
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-26
• Weakness: CWE-416

Description

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Summary

CVE-2026-109619 is a high-severity (CVSS 8.1) remote code execution flaw in PHP caused by global state that can point to freed request memory and be read or branched on by later requests before full initialization. It affects PHP (fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12) and products bundling it, including Palo Alto Networks PAN-OS (fixed in 10.2.7, 11.1.4, 11.2.4, 12.1.4), Panorama Virtual Appliance, and Siemens Ruggedcom Ape1808 Firmware. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog and EPSS estimates a 100.0% probability of exploitation in 30 days, so treat it as actively exploited. Apply the fixed versions or vendor mitigations per CISA BOD 26-04, and discontinue use of affected products where no mitigation exists.

CVE-2026-109619 ثغرة تنفيذ تعليمات برمجية عن بُعد (RCE) عالية الخطورة (CVSS 8.1) في PHP، سببها حالة عامة (global state) قد تشير إلى ذاكرة طلب تم تحريرها ثم تُقرأ أو يُتفرع عليها في طلبات لاحقة قبل تهيئتها بالكامل. تؤثر الثغرة في PHP (تم الإصلاح في 8.2.35 و8.3.36 و8.4.27 و8.5.12) وفي منتجات تتضمنها، منها Palo Alto Networks PAN-OS (تم الإصلاح في 10.2.7 و11.1.4 و11.2.4 و12.1.4) وPanorama Virtual Appliance وSiemens Ruggedcom Ape1808 Firmware. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال، ويقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 100.0%، لذا يجب التعامل معها كثغرة مستغلة فعلياً. طبّق الإصدارات المُصلحة أو تخفيفات الجهة المصنّعة وفق CISA BOD 26-04، وأوقف استخدام المنتجات المتأثرة إذا لم يتوفر تخفيف.

Affected products

• Palo Alto Networks PAN-OS: from 10.2.0 before 10.2.7; from 11.1.0 before 11.1.4; from 11.2.0 before 11.2.4; from 12.1.0 before 12.1.4; from 12.2.0 before 12.2.4; 10.2.7, 10.2.7-h1, 10.2.7-h10, 10.2.7-h11, 10.2.7-h12, 10.2.7-h13 (+279) — fixed in 10.2.7, 11.1.4, 11.2.4, 12.1.4, 12.2.4
• Paloaltonetworks Panorama Virtual Appliance: all versions
• PHP: from 5.4.0 before 8.2.35; from 8.3.0 before 8.3.36; from 8.4.0 before 8.4.27; from 8.5.0 before 8.5.12 — fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12
• Siemens Ruggedcom Ape1808 Firmware: all versions

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.2.7, 11.1.4, 11.2.4, 12.1.4; PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12. Check the vendor advisory for mitigations.

In the news

• 2026-018: Critical Vulnerabilities in PHP
• Vulnerabilities in PHP Affecting Cisco Products: October 2026
• Discover and remediate PHP2Shell exposure with Tenable
• Industrial Vendors Check Products for PHP2Shell Vulnerabilities
• PHP2Shell Exploitation Moves From Probes to Working Shells
• CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)
• PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
• Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)

References

• https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
• http://www.openwall.com/lists/oss-security/2026/10/21/16
• http://www.openwall.com/lists/oss-security/2026/10/21/17
• http://www.openwall.com/lists/oss-security/2026/10/21/23
• http://www.openwall.com/lists/oss-security/2026/10/21/7
• http://www.openwall.com/lists/oss-security/2026/10/22/14
• http://www.openwall.com/lists/oss-security/2026/10/22/15
• http://www.openwall.com/lists/oss-security/2026/10/22/16
• http://www.openwall.com/lists/oss-security/2026/10/22/19
• http://www.openwall.com/lists/oss-security/2026/10/22/2
• http://www.openwall.com/lists/oss-security/2026/10/22/20
• http://www.openwall.com/lists/oss-security/2026/10/23/4

Get alerted when CVE-2026-109619 or the next vulnerability affects your stack