CVE-2026-109619: PHP Stale Request-State Use-After-Free RCE

CVE-2026-109619 is a use-after-free in PHP caused by global state that keeps pointing at per-request memory after it has been freed or reset incorrectly, so an attacker who can send a "producer" request that stores stale state followed by a "consumer" request handled by the same worker can trigger remote code execution without authentication — CISA added it to KEV alongside the related CVE-2026-109618 under the same "php2shell" alert.

CVE-2026-109619 (CWE-416, part of a CWE cluster including CWE-755, CWE-824, CWE-1325 and CWE-1419) is a use-after-free vulnerability in PHP. PHP keeps various pieces of global state that temporarily point into request-scoped memory; in some scenarios that global state is not correctly reset when the request ends, or is repopulated after being reset, so it can still refer to memory that has already been freed. A subsequent request handled by the same long-lived worker process may then read or branch on that freed memory (NVD).

The PHP project's security advisory describes two confirmed exploitation paths: one via fatal-error backtrace handling, and one via the session upload-progress lifecycle. Both require a "producer" operation in one request that stores request-owned state, followed by a "consumer" operation in a later request on the same worker that accesses that now-stale state — the advisory frames this as needing two requests against the same persistent PHP worker, which is the normal case for PHP-FPM, mod_php and similar long-running SAPIs (PHP Security Advisory GHSA-6wmf-4rv5-p3rp).

NVD's own analysis scores this CVSS v3.1 8.1 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable and unauthenticated, but with high attack complexity reflecting the two-request chaining requirement. The PHP project's own CVSS v4.0 submission is higher, at 9.2 (critical) (NVD).

CISA's joint alert covering both CVE-2026-109618 and CVE-2026-109619 states the pair affects "all PHP installations that process web requests, including (but not limited to) deployments using Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed," with confirmed exploitation reaching unauthenticated remote code execution. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and organizations unable to patch immediately are told to take PHP 8.1-or-earlier unsupported installs offline (CISA Alert: Critical Vulnerabilities in PHP Require Immediate Patching).

CISA added CVE-2026-109619 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-26, same batch as CVE-2026-109618, with a required-action due date of 2026-10-29 and a forensics-triage flag under BOD 26-04; known ransomware-campaign use is recorded as "Unknown" as of that date (CISA KEV).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.99997 (99.989th percentile), essentially the maximum of the EPSS scale, consistent with CISA's active-exploitation finding (FIRST EPSS).

Because both PHP CVEs were disclosed and added to KEV together and share the same fixed releases, any PHP deployment being patched for CVE-2026-109618 should be updated to the same fixed version to close this issue as well.

• Global state pointing into per-request memory can outlive that memory (use-after-free) if not correctly reset between requests on the same worker. — NVD
• Two confirmed exploitation paths (fatal-error backtrace handling, session upload-progress lifecycle) require a producer request followed by a consumer request on the same worker; fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12. — PHP Security Advisory GHSA-6wmf-4rv5-p3rp
• CVSS v3.1 base score is 8.1 (high), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, per NVD's own analysis. — NVD
• Affects all PHP deployments handling web requests (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed); confirmed unauthenticated RCE exploitation alongside CVE-2026-109618. — CISA Alert: Critical Vulnerabilities in PHP Require Immediate Patching
• Added to the CISA KEV catalog on 2026-10-26, due date 2026-10-29, with a forensics-triage requirement under BOD 26-04. — CISA KEV
• EPSS score is 0.99997 (99.989th percentile) as of 2026-10-26. — FIRST EPSS