Vulnerability of 3 November 2026 · CVE-2026-109619

PHP Use after free

8.1 CVSS · highExploited

Use after free in PHP. Exploitable over the network, without logging in, without any user action. CVSS 8.1 (high). According to CISA it is already being exploited. Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Vendor security advisory

github.com · The vendor’s information prevails.

At a glance

CVE

CVE-2026-109619

Product

PHP

Vendor

The PHP Group

Affected versions

≥ 8.2.0, < 8.2.35
≥ 8.3.0, < 8.3.36
≥ 8.4.0, < 8.4.27
≥ 8.5.0, < 8.5.12

per the vendor or CVE issuer

Fixed in

8.2.35, 8.3.36, 8.4.27, 8.5.12

CVSS

8.1 (high)
CVSS 3.1, scored by NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Known exploited

Yes, per CISA (in the KEV catalog since 26 October 2026)

Weakness type

CWE-416 (Use after free), CWE-755, CWE-824, CWE-1325

Published

21 October 2026

Last modified

2 November 2026

What to do

Update to a fixed version: 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later, depending on the release line you run.
Read the vendor’s report: it gives the exact versions and, where available, workarounds in case you cannot update right away.
Since it is already exploited: after updating, check whether the system was compromised before.
Also check test, staging and forgotten installations of the same software.

Vendor security advisory ↗

Original description

From the CVE record. The summary above is built from the structured data.

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Name at CISA: PHP Stale Internal Request-State Vulnerability

Official references

github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rpMitigationVendor advisory
arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-executionThird-party advisory
cert-portal.siemens.com/productcert/html/ssa-166980.htmlThird-party advisory
cert-portal.siemens.com/productcert/html/ssa-566435.htmlThird-party advisory
cert-portal.siemens.com/productcert/html/ssa-566512.htmlThird-party advisory
php2shell.delftintellab.comThird-party advisory
cisa.gov/known-exploited-vulnerabilities-catalogUS government
wiz.io/blog/php2shell-php-rceThird-party advisory

Sources

Data from NIST’s NVD and CISA’s KEV catalog, retrieved on 3 November 2026. This product uses data from the NVD API but is not endorsed or certified by the NVD. No liability is accepted for this information.

NVD entry ↗CVE.org record ↗CISA KEV catalog ↗

Which software versions does your website give away? The free security check finds out.

Check for free