Vulnerability record/PUBLISHED/Published Oct 21, 2026 13:54:43 UTC
CVE-2026-109619
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Base score9.2/ 10
SeverityCriticalCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityCritical
Attack vectorNetworkAV
Attack complexityHighAC
Attack requirementsPresentAT
Privileges requiredNonePR
User interactionNoneUI
Vulnerable system confidentialityHighVC
Vulnerable system integrityHighVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityphp
Last updatedNov 5, 2026 18:17:39 UTC
PublishedOct 21, 2026 13:54:43 UTC
ReservedOct 12, 2026 21:04:00 UTC
Credits
- Wiz
- Ryan at Calif.io
- OpenAI
- Arnaud Le Blanc
- Ilija Tovilo
- Jakub Zelenka
- Nora Dossche