Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Published: 2026-10-21
Score: 9.2 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Workaround

Check the GitHub Security Advisory for mitigation strategies.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4848-1 php8.2 security update
Debian DSA Debian DSA DSA-6574-1 php8.4 security update
Ubuntu USN Ubuntu USN USN-8948-1 PHP vulnerabilities
Ubuntu USN Ubuntu USN USN-8948-2 PHP vulnerabilities
History

Wed, 21 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
References

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Php
Php php
CPEs cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Vendors & Products Php
Php php
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Title RCE via stale global state
Weaknesses CWE-1325
CWE-1419
CWE-416
CWE-755
CWE-824
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Php Php
cve-icon MITRE

Status: PUBLISHED

Assigner: php

Published:

Updated: 2026-10-21T18:10:07.691Z

Reserved: 2026-10-12T21:04:00.504Z

Link: CVE-2026-109619

cve-icon Vulnrichment

Updated: 2026-10-21T16:07:53.580Z

cve-icon NVD

Status : Modified

Published: 2026-10-21T14:17:09.823

Modified: 2026-10-21T17:18:24.437

Link: CVE-2026-109619

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-1325

    Improperly Controlled Sequential Memory Allocation

  • CWE-1419

    Incorrect Initialization of Resource

  • CWE-416

    Use After Free

  • CWE-755

    Improper Handling of Exceptional Conditions

  • CWE-824

    Access of Uninitialized Pointer