CVE-2026-109619 PHP Group PHP
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed.…
- CVSS
- 9.2 Critical
- EPSS
- 100%
- Percentile
- 100
- Published
- 2026-10-21
- Force
- 11 of 12
- Public PoC
- 30
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
On CISA’s exploited list
PHP Stale Internal Request-State Vulnerability
- Added
- 2026-10-26
- Federal patch deadline
- 2026-10-29
- Ransomware use
- not known
In the news
- Siemens RUGGEDCOM APE1808CISA Advisories · 2026-11-12
- Siemens Building Automation and Energy ProductsCISA Advisories · 2026-11-12
- Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)Unit 42 · 2026-10-29
- CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA Advisories · 2026-10-26