CVE search · CVE-2026-109619
CVE-2026-109619
critical 9.2 Known exploited
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Details
- Status
- Analyzed
- Published
- Last changed
- Source
- security@php.net
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 4.0 | critical 9.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
security@php.netSecondary |
| CVSS 3.1 | high 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- php · php
- siemens · ruggedcom_ape1808_firmware
- paloaltonetworks · pan-os
- paloaltonetworks · panorama_virtual_appliance
- siemens · amis_ts
- siemens · blueplanet_360_nx3_m6_wm_od_iisx-s_firmware
- siemens · energy_engage
- siemens · spectrum_power_3
- siemens · spectrum_power_4
- siemens · spectrum_power_7
- siemens · spectrum_power_tg
- siemens · blueplanet_360_nx3_m6_wm_od_iisx_firmware
References
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rpMitigationVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/16Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/17Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/23Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/7Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/14Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/15Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/16Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/19Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/2Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/20Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/23/4Mailing ListThird Party Advisory
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-166980.htmlThird Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-566435.htmlThird Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-566512.htmlThird Party Advisory
- https://php2shell.delftintellab.com/Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619US Government Resource
- https://www.wiz.io/blog/php2shell-php-rceThird Party Advisory