CVE-2026-109619
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Executive briefing
The source record describes: PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). The practical risk depends on whether an affected product/version is present, reachable and configured in an exploitable way. Review the affected-product evidence and linked vendor advisories before assigning exposure status.
Evidence confidence: Moderate Evidence-derived, not an exploitability verdict
Severity & attack characteristics
CVSS vector:CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CISA KEV: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Technical explanation & impact
The technical mechanism is not expanded beyond the source description unless a referenced advisory supplies additional evidence. Read the linked vendor/CERT advisories for root-cause detail.
Potential impact must be interpreted from the published CVSS impact metrics and the affected component. A CVSS impact score is not proof that a particular asset is exploitable.
Weakness classification
CWE-416CWE-755CWE-824CWE-1325Affected products and versions
Products below are parsed from NVD vulnerable CPE configuration entries. Version boundaries are shown as published; verify applicability with the vendor.
| Vendor | Product | Version evidence |
|---|---|---|
| php | php | from (inclusive) 8.5.0; before 8.5.12 |
| siemens | ruggedcom_ape1808_firmware | Version not specified in CPE |
| paloaltonetworks | pan-os | from (inclusive) 12.2.0; before 12.2.4 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.7 · CPE version 10.2.8 · CPE version 10.2.9 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.10 · CPE version 10.2.11 · CPE version 10.2.12 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.13 · CPE version 10.2.14 · CPE version 10.2.15 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.16 · CPE version 10.2.17 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 10.2.18 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.4 · CPE version 11.1.5 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.6 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.7 · CPE version 11.1.8 · CPE version 11.1.9 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.10 · CPE version 11.1.11 · CPE version 11.1.12 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.13 · CPE version 11.1.14 · CPE version 11.1.15 · CPE version 11.1.16 · CPE version 11.1.16 · CPE version 11.1.16 · CPE version 11.1.16 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.4 · CPE version 11.2.5 · CPE version 11.2.6 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.7 · CPE version 11.2.8 · CPE version 11.2.9 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.10 · CPE version 11.2.11 · CPE version 11.2.12 · CPE version 11.2.13 · CPE version 11.2.13 · CPE version 11.2.13 · CPE version 11.2.13 · CPE version 11.2.15 · CPE version 11.2.16 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.4 · CPE version 12.1.5 · CPE version 12.1.6 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.7 · CPE version 12.1.8 · CPE version 12.1.9 · CPE version 12.1.10 · CPE version 12.1.10 · CPE version 12.2.4 |
| paloaltonetworks | panorama_virtual_appliance | Version not specified in CPE |
| siemens | amis_ts | Version not specified in CPE |
| siemens | blueplanet_360_nx3_m6_wm_od_iisx-s_firmware | Version not specified in CPE |
| siemens | energy_engage | CPE version 2.0 · CPE version 3.1 |
| siemens | spectrum_power_3 | Version not specified in CPE |
| siemens | spectrum_power_4 | Version not specified in CPE |
| siemens | spectrum_power_7 | Version not specified in CPE |
| siemens | spectrum_power_tg | Version not specified in CPE |
| siemens | blueplanet_360_nx3_m6_wm_od_iisx_firmware | Version not specified in CPE |
Remediation & validation
- Prioritize immediately: CISA lists this CVE in its Known Exploited Vulnerabilities catalog. Confirm exposure, apply the vendor fix and validate mitigation.
- Identify exposure by comparing the affected product and version ranges with your asset inventory, SBOM and externally exposed services.
- Review the linked vendor security advisory or patch notes. Upgrade to a vendor-confirmed fixed release; do not infer a fixed version from the CVE description.
- Until patched, consider restricting network access or disabling the affected feature where operationally safe. These are temporary controls, not a substitute for a vendor fix.
- Validate the remediation with a version check and vulnerability rescan, then retain change evidence.
No fixed version is displayed unless it is explicitly established by a vendor advisory. Follow the vendor's release notes for exact product and branch applicability.
Vendor advisories, patches & exploit references
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp ADVISORY security@php.net
- http://www.openwall.com/lists/oss-security/2026/10/21/16 ADVISORY af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2026/10/21/17 ADVISORY af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2026/10/21/23 ADVISORY af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2026/10/21/7 ADVISORY af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2026/10/22/14 ADVISORY af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2026/10/22/15 ADVISORY af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2026/10/22/16 ADVISORY af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2026/10/22/19 ADVISORY af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2026/10/22/2 ADVISORY af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2026/10/22/20 ADVISORY af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2026/10/23/4 ADVISORY af854a3a-2127-422b-91ae-364da2661108
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/ ADVISORY 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://cert-portal.siemens.com/productcert/html/ssa-166980.html ADVISORY 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
- https://cert-portal.siemens.com/productcert/html/ssa-566435.html ADVISORY 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
- https://cert-portal.siemens.com/productcert/html/ssa-566512.html ADVISORY 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
- https://php2shell.delftintellab.com/ ADVISORY 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619 EXPLOIT 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://www.wiz.io/blog/php2shell-php-rce ADVISORY 134c704f-9b21-4f2e-91b3-4a467353bcc0