ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-109619

PHP PHP Use After Free

Published Oct 21, 2026 · catalog updated Oct 23, 2026 · PHP PHP Use After

Patch now

CVE-2026-109619 is in the CISA known-exploited catalog. Confirm PHP PHP Use After against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (PHP PHP Use After).
Severity
Critical9.2
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
5.99%
Remediation
Remediation guidance
Affected products
Bitnami libphp · Bitnami php · Bitnami php-min · cpe php/php · package unmanaged · vendor PHP Group

Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges. CVE CVSSv4 Description CVE-2026-109618 9.2 (Critical) RCE via OOM corruption CVE-2026-109619 9.2 (Critical) RCE via stale global state All installations serving web requests are at risk, inc

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Bitnami libphp0 → 8.2.35
  • Bitnami php0 → 8.2.35
  • Bitnami php-min0 → 8.2.35
  • cpe php/php< 8.2.35
  • cpe php/php< 8.3.36
  • cpe php/php< 8.4.27
  • cpe php/php< 8.5.12
  • package unmanagedversion unspecified
  • vendor PHP Groupversion unspecified
  • vendor PHP PHPversion unspecified

How to fix CVE-2026-109619

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2026-109619 is in the CISA known-exploited catalog. Confirm PHP PHP Use After against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with 0 → 8.2.35, < 8.2.35, < 8.3.36, < 8.4.27, < 8.5.12. Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

What should an analyst verify?

CWE-1325; CWE-416: Use After Free; CWE-755: Improper Handling of Exceptional Conditions. EPSS 5.99%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Cisco securityUbuntu securityWordPress security

Code

The project this record applies to. Exploit listings stay in References.

Related records

Linked stories and findings that share CVE identifiers or explicit correlation edges.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 21, 2026 · VulnCheck KEV

    Detected

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and pro

  2. Oct 21, 2026 · CISA KEV

    Known exploited

    Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

  3. Oct 21, 2026 · NIST NVD

    Updated

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and pro

  4. Oct 21, 2026 · NIST NVD

    Updated

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and pro

  5. Oct 21, 2026 · NIST NVD

    Updated

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and pro

  6. Oct 22, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    libphp fixed in 8.2.35

  7. Oct 22, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    php-min fixed in 8.2.35

  8. Oct 22, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    php fixed in 8.2.35

  9. Oct 22, 2026 · NIST NVD

    Updated

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and pro

  10. Oct 22, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    libphp fixed in 8.2.35

  11. Oct 22, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    php-min fixed in 8.2.35

  12. Oct 22, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    php fixed in 8.2.35

  13. Oct 22, 2026 · NIST NVD

    Updated

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and pro

  14. Oct 23, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and pro

  15. Oct 23, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and pro

  16. Oct 23, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and pro

  17. Oct 23, 2026 · NIST NVD

    Updated

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and pro

Sources

  • AWS Security BulletinsVendor advisoryCVE-2026-109619

    Bulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Summary: Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) allow an unauthenticated remote actor to execute code, access process-acc

    aws.amazon.com
  • BSI CERT-BundGovernment advisoryCVE-2026-109619

    PHP: Mehrere Schwachstellen ermöglichen Codeausführung

    wid.cert-bund.de
  • Canadian Centre for Cyber SecurityGovernment advisoryCVE-2026-109619

    Number: AL26-026 Date: October 21, 2026 Updated: October 23, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide addition

    cyber.gc.ca
  • CERT/CC Vulnerability NotesGovernment advisoryCVE-2026-109619

    Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potent

    kb.cert.org
  • CISA Cybersecurity AdvisoriesGovernment advisoryCVE-2026-109619

    CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 . These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installation

    cisa.gov
  • Cisco Security AdvisoriesVendor advisoryCVE-2026-109619

    On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advi

    sec.cloudapps.cisco.com
  • Cloudflare SecurityVendor advisoryCVE-2026-109619

    Cloudflare deploys protections against php2shell vulnerability | Cloudflare Blog

    blog.cloudflare.com
  • CVE.orgVulnerability recordCVE-2026-109619

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-109619

    30-day exploitation probability 5.99%

    first.org
  • EUVDVulnerability recordEUVD-2026-107265

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may r

    euvd.enisa.europa.eu
  • Full DisclosureThreat researchCVE-2026-109619

    Research mention from Full Disclosure. Not confirmation of exploitation.

    seclists.org
  • Google Cloud Security BulletinsVendor advisoryCVE-2026-109619

    Published: 2026-10-21 Description Description Severity Notes Two remote code execution vulnerabilities were found in the open-source PHP language . While Google Cloud itself is not vulnerable, users of this language running on Google Cloud may be vulnerable. The following languag

    docs.cloud.google.com
  • Gentoo GLSAVendor advisoryCVE-2026-109619

    PHP: Multiple Vulnerabilities (GLSA 202610-02) — Gentoo security

    security.gentoo.org
  • JPCERT/CCGovernment advisoryCVE-2026-109619

    JPCERT コーディネーションセンター

    jpcert.or.jp
  • NCSC NetherlandsGovernment advisoryCVE-2026-109619

    PHP heeft twee kritieke kwetsbaarheden verholpen. De kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt voor het uitvoeren van willekeurige code. Alle PHP-installaties die webverzoeken verwerken zijn getroffen. De kwetsbaarheid met kenmerk CVE-2026-109618 betr

    advisories.ncsc.nl
  • NIST NVDVulnerability recordCVE-2026-109619

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may r

    nvd.nist.gov
  • Openwall OSS SecurityThreat researchCVE-2026-109619

    Research mention from Openwall OSS Security. Not confirmation of exploitation.

    openwall.com
  • OpenSSF OSV / OSV ScannerPackage advisoryBIT-libphp-2026-109619

    RCE via stale global state

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryBIT-php-2026-109619

    RCE via stale global state

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryBIT-php-min-2026-109619

    RCE via stale global state

    osv.dev
  • Palo Alto NetworksVendor advisoryCVE-2026-109619
    security.paloaltonetworks.com
  • Patchstack DatabaseVendor advisoryCVE-2026-109619

    PHP has released the fix. Update now. PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and L

    patchstack.com
  • Rapid7 Vulnerability DatabaseResearchCVE-2026-109619

    Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's pr

    rapid7.com
  • Kaspersky SecurelistThreat researchCVE-2026-109619

    Research mention from Kaspersky Securelist. Not confirmation of exploitation.

    securelist.com
  • Snyk Vulnerability DatabasePackage advisorySNYK-UNMANAGED-PHP-21347796

    Remote Code Execution (RCE)

    security.snyk.io
  • Cisco TalosVendor advisoryCVE-2026-109619

    Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset.

    blog.talosintelligence.com
  • Ubuntu Security NoticesVendor advisoryCVE-2026-109619

    USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP i

    ubuntu.com
  • Palo Alto Unit 42Threat researchCVE-2026-109619

    Research mention from Palo Alto Unit 42. Not confirmation of exploitation.

    unit42.paloaltonetworks.com
  • VulnCheck KEVConfirmed exploitationCVE-2026-109619

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may r

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 23, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.