CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

• CWE-416
• CWE-755
• CWE-824
• CWE-1325

• https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rpMitigation, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/10/21/16Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2026/10/21/17Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2026/10/21/23Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2026/10/21/7Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2026/10/22/14Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2026/10/22/15Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2026/10/22/16Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2026/10/22/19Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2026/10/22/2Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2026/10/22/20Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2026/10/23/4Mailing List, Third Party Advisory
• https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/Third Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-166980.htmlThird Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-566435.htmlThird Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-566512.htmlThird Party Advisory
• https://php2shell.delftintellab.com/Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619US Government Resource
• https://www.wiz.io/blog/php2shell-php-rceThird Party Advisory

Published

Oct 21, 2026

Last Modified

Nov 5, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-109613Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 conta…7.1
• CVE-2026-109614Frappe ERPNext before 16.34.0 contains a missing authorizati…6.5
• CVE-2026-109615Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 conta…6.5
• CVE-2026-109616Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 conta…7.1
• CVE-2026-109617Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 conta…7.1
• CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit th…9.8
• CVE-2026-10962Type Confusion in Media in Google Chrome prior to 149.0.7827…8.8
• CVE-2026-109620A vulnerability has been found in SourceCodester Online Revi…7.3
• CVE-2026-109621Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 conta…6.5
• CVE-2026-109622Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 conta…4.3
• CVE-2026-109623Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 conta…5.4
• CVE-2026-109624Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 conta…6.5