PHP stale global state vulnerability allows remote code execution (CVE-2026-109619)

What happened

PHP maintains global state that can temporarily point into memory used by an individual request. In some scenarios this state is not reset correctly, or is repopulated after being reset, so it can refer to request memory after that memory has been freed. A later request may then read or branch on the stale state before it is fully initialised. The CVE record notes that multiple strategies can trigger this condition and produce remote code execution.

The CVSS 4.0 vector rates this critical at 9.2. The flaw is network-reachable and requires no privileges or user interaction, but has high attack complexity and present attack requirements, meaning successful exploitation depends on the specific environment and timing. CISA's KEV catalogue lists this as exploited and gives a due date of 29 October 2026 for applying mitigations. Ransomware use is listed as unknown.

Who is affected

Affected PHP versions are 8.2.* before 8.2.35, 8.3.* before 8.3.36, 8.4.* before 8.4.27 and 8.5.* before 8.5.12. This applies to PHP 8.2, 8.3, 8.4 and 8.5 branches until those fixed releases are installed. Organisations running web applications or services built on PHP should treat all hosts, containers and images on those branches as in scope.

What to do now

1. Identify every system, container image and application dependency running PHP 8.2, 8.3, 8.4 or 8.5.
2. Upgrade each affected branch to its fixed release: PHP 8.2.35, PHP 8.3.36, PHP 8.4.27 or PHP 8.5.12.
3. Prioritise internet-facing PHP services. CISA's due date is 29 October 2026, so complete the upgrade as soon as possible.
4. Where immediate patching is not possible, restrict network access to PHP services until the fixed release is applied.

Beyond the patch

Because this flaw is exploited and reachable over the network without credentials, it is not only a patching task but an exposure and response problem. Virtual CISO Services can help identify which internet-facing PHP assets are in scope and set a patching cadence. Where an organisation suspects it has already been hit, Managed Detection & Response (MDR) and an Incident Response Retainer provide detection and response capability for post-exploitation activity.