CVE-2026-109619: RCE via stale global state
CVE-2026-109619 is a critical (CVSS 9.2) PHP use-after-free: state from one request can survive into the next request on the same worker and lead to remote code execution. It is fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Both mod_php and PHP-FPM have validated attack paths.
| CVE | CVE-2026-109619 |
|---|---|
| Advisory | GHSA-6wmf-4rv5-p3rp |
| Published | 2026-10-21 |
| Severity | Critical CVSS v4.0 9.2 |
| Weakness | CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 |
| Fixed in | 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
| Related | CVE-2026-109618 (RCE via OOM corruption) — fixed in the same releases |
What it is
Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it, causing a use-after-free that can lead to remote code execution.
Confirmed paths (per the advisory)
- PHP 8.5 fatal error backtraces (
fatal_error_backtracesenabled): the strongest case, confirmed RCE against mod_php. - Session upload progress (enabled by default, no
session_start()needed): validated against mod_php and FPM. - INI diagnostics before request start: invalid or deprecated per-request settings via
.htaccess(mod_php) orPHP_VALUE(FPM).
Other error, exception, object and extension state is conditionally affected, depending on the application and extensions. There is no complete configuration mitigation.
Affected and fixed versions
| Branch | Affected | Fixed in | Status |
|---|---|---|---|
| PHP 8.5 | < 8.5.12 | 8.5.12 | Fixed release available |
| PHP 8.4 | < 8.4.27 | 8.4.27 | Fixed release available |
| PHP 8.3 | < 8.3.36 | 8.3.36 | Fixed release available |
| PHP 8.2 | < 8.2.35 | 8.2.35 | Fixed release available PHP 8.2 reaches end of life on 31 December 2026. |
| PHP 8.6 | < 8.6.0RC4 | 8.6.0RC4 | Pre-release Pre-release. RC4 contains the fixes; earlier 8.6.0 builds are affected. Not for production. |
| PHP 8.1 | all | — | End of life No official release. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1; distributions and LTS vendors may ship backported packages with the same version number. |
| PHP 8.0 | all | — | End of life No official release. Source backport and vendor packages only. |
| PHP 7.4 | all | — | End of life No official release. Source backport and vendor packages only. |
Distribution packages may be fixed under an older-looking version number: see backports.
What to do
- Check your site to see which PHP version it reports.
- Confirm on the server with the self-check commands.
- Update PHP and restart every PHP worker.
- If you can’t update right away, apply the temporary mitigations.
This page intentionally contains no exploit details or proof-of-concept code.
FAQ
Is CVE-2026-109619 exploitable remotely?
Yes. The advisory confirms unauthenticated use-after-free, memory disclosure and remote code execution with the web worker’s privileges. The fatal-error backtrace path was confirmed against mod_php; the session upload progress path was validated against both mod_php and FPM.
Does turning off display_errors help?
No. Global state is accessed before PHP decides whether to report, display or log a warning, so error_reporting, @, display_errors and log_errors do not protect you.
How do I fix CVE-2026-109619?
Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or your distribution’s patched package, and restart every worker. session.upload_progress.enabled=0 and (on 8.5) fatal_error_backtraces=0 block the confirmed paths only.