PHP RCE via stale global state
CVE-2026-109619 Published on October 21, 2026

RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Vendor Advisory NVD

Known Exploited Vulnerability

This PHP Stale Internal Request-State Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.

The following remediation steps are recommended / required by October 29, 2026: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicab

Vulnerability Analysis

CVE-2026-109619 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:

NETWORK

Attack Complexity:

HIGH

Privileges Required:

NONE

User Interaction:

NONE

Weakness Types

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2026-109619 has been classified to as a Dangling pointer vulnerability or weakness.

Improper Handling of Exceptional Conditions

The software does not handle or incorrectly handles an exceptional condition.

Access of Uninitialized Pointer

The program accesses or uses a pointer that has not been initialized.

What is a Stack Exhaustion Vulnerability?

The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.

CVE-2026-109619 has been classified to as a Stack Exhaustion vulnerability or weakness.

CWE-1419

Products Associated with CVE-2026-109619

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-109619 are published in these products:

Canonical Ubuntu Linux

Amazon Aws

Oracle

PHP

Affected Versions

PHP Group PHP:

Version 8.2.* and below 8.2.35 is affected.
Version 8.3.* and below 8.3.36 is affected.
Version 8.4.* and below 8.4.27 is affected.
Version 8.5.* and below 8.5.12 is affected.

Siemens AX4:

Before * is unaffected.

Siemens CADRA:

Before * is unaffected.

Siemens Capital:

Before * is unaffected.

Siemens Designcenter:

Before * is unaffected.

Siemens Designcenter X:

Before * is unaffected.

Siemens DFMExpress:

Before * is unaffected.

Siemens HyperLynx:

Before * is unaffected.

Siemens Insights Hub:

Before * is unaffected.

Siemens Opcenter Connect Electronics:

Before * is unaffected.

Siemens Opcenter Connect MOM:

Before * is unaffected.

Siemens Opcenter Execution Core:

Before * is unaffected.

Siemens Opcenter Execution Foundation:

Before * is unaffected.

Siemens Opcenter Execution Pharma:

Before * is unaffected.

Siemens Opcenter Intelligence:

Before * is unaffected.

Siemens Opcenter Intra Plant Logistics:

Before * is unaffected.

Siemens Opcenter Quality:

Before * is unaffected.

Siemens Opcenter RDnL:

Before * is unaffected.

Siemens Opcenter X:

Before * is unaffected.

Siemens PADS Pro Essentials:

Before * is unaffected.

Siemens PADS Pro Student Edition:

Before * is unaffected.

Siemens PADS Professional:

Before * is unaffected.

Siemens PADS Professional - XCR:

Before * is unaffected.

Siemens PADS Standard - XCR:

Before * is unaffected.

Siemens PADS Standard & Standard Plus:

Before * is unaffected.

Siemens Polarion:

Before * is unaffected.

Siemens QuadView:

Before * is unaffected.

Siemens RUGGEDCOM APE1808:

Before * is affected.

Siemens Simcenter Flomaster:

Before * is unaffected.

Siemens Simcenter Flux:

Before * is unaffected.

Siemens Simcenter Simlab:

Before * is unaffected.

Siemens Solid Edge:

Before * is unaffected.

Siemens Solid Edge:

Before * is unaffected.

Siemens Supply Chain Suite:

Before * is unaffected.

Siemens Teamcenter:

Before * is unaffected.

Siemens Teamcenter Product Cost Management:

Before * is unaffected.

Siemens Teamcenter Visualization:

Before * is unaffected.

Siemens Tecnomatix Plant Simulation:

Before * is unaffected.

Siemens TestWay:

Before * is unaffected.

Siemens Valor NPI:

Before * is unaffected.

Siemens Xcargo:

Before * is unaffected.

Siemens Xpedition Designer:

Before * is unaffected.

Siemens Xpedition Enterprise:

Before * is unaffected.

Siemens Xpedition Enterprise XCR:

Before * is unaffected.

Siemens Xpedition IC Packaging:

Before * is unaffected.

Siemens Xpedition Layout Browser:

Before * is unaffected.

Siemens AMIS TS:

Before * is affected.

Siemens blueplanet 360 NX3 M6 WM OD IISX:

Before * is affected.

Siemens blueplanet 360 NX3 M6 WM OD IISX - S:

Before * is affected.

Siemens Energy Engage V2.0SP9:

Before * is affected.

Siemens Energy Engage V3.1SP1:

Before * is affected.

Siemens Spectrum Power 3:

Before * is affected.

Siemens Spectrum Power 4:

Before * is affected.

Siemens Spectrum Power 4:

Before * is affected.

Siemens Spectrum Power 4:

Before * is affected.

Siemens Spectrum Power 7:

Before * is affected.

Siemens Spectrum Power TG:

Before * is affected.

PHP RCE via stale global stateCVE-2026-109619 Published on October 21, 2026

Known Exploited Vulnerability

Vulnerability Analysis

Weakness Types

What is a Dangling pointer Vulnerability?

Improper Handling of Exceptional Conditions

Access of Uninitialized Pointer

What is a Stack Exhaustion Vulnerability?

Products Associated with CVE-2026-109619

Affected Versions

PHP RCE via stale global state
CVE-2026-109619 Published on October 21, 2026