CVE Details

CVE-2026-109619 PHP Stale Internal Request-State Vulnerability
Published: 2026-10-26 CVSS: 9.2 CRITICAL Product: PHP Group PHP Due Date: 2026-10-29

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.
  • ikow/php2shell-poc • ⭐ 1831 • 2026-10-21 • Conf: 96.0%
  • CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
  • eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC • ⭐ 1018 • 2026-10-21 • Conf: 95.0%
  • Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 9.2
  • Severity: CRITICAL
  • Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

  • Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-109619
cveMetadata > assignerOrgId dd77f84a-d19a-4638-8c3d-a322d820ed2b
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName php
cveMetadata > dateReserved 2026-10-12T21:04:00.504Z
cveMetadata > datePublished 2026-10-21T13:54:43.866Z
cveMetadata > dateUpdated 2026-10-23T14:07:57.152Z
containers > cna > providerMetadata > orgId dd77f84a-d19a-4638-8c3d-a322d820ed2b
containers > cna > providerMetadata > shortName php
containers > cna > providerMetadata > dateUpdated 2026-10-21T13:54:43.866Z
containers > cna > title RCE via stale global state
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-416
containers > cna > problemTypes > 0 > descriptions > 0 > description CWE-416 Use after free
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > problemTypes > 1 > descriptions > 0 > lang en
containers > cna > problemTypes > 1 > descriptions > 0 > cweId CWE-755
containers > cna > problemTypes > 1 > descriptions > 0 > description CWE-755 Improper Handling of Exceptional Conditions
containers > cna > problemTypes > 1 > descriptions > 0 > type CWE
containers > cna > problemTypes > 2 > descriptions > 0 > lang en
containers > cna > problemTypes > 2 > descriptions > 0 > cweId CWE-824
containers > cna > problemTypes > 2 > descriptions > 0 > description CWE-824 Access of uninitialized pointer
containers > cna > problemTypes > 2 > descriptions > 0 > type CWE
containers > cna > problemTypes > 3 > descriptions > 0 > lang en
containers > cna > problemTypes > 3 > descriptions > 0 > cweId CWE-1325
containers > cna > problemTypes > 3 > descriptions > 0 > description CWE-1325 Improperly controlled sequential memory allocation
containers > cna > problemTypes > 3 > descriptions > 0 > type CWE
containers > cna > problemTypes > 4 > descriptions > 0 > lang en
containers > cna > problemTypes > 4 > descriptions > 0 > cweId CWE-1419
containers > cna > problemTypes > 4 > descriptions > 0 > description CWE-1419 Incorrect Initialization of Resource
containers > cna > problemTypes > 4 > descriptions > 0 > type CWE
containers > cna > impacts > 0 > capecId CAPEC-234
containers > cna > impacts > 0 > descriptions > 0 > lang en
containers > cna > impacts > 0 > descriptions > 0 > value CAPEC-234 Hijacking a privileged process
containers > cna > affected > 0 > vendor PHP Group
containers > cna > affected > 0 > product PHP
containers > cna > affected > 0 > packageName php-src
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > version 8.2.*
containers > cna > affected > 0 > versions > 0 > lessThan 8.2.35
containers > cna > affected > 0 > versions > 0 > versionType semver
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 1 > version 8.3.*
containers > cna > affected > 0 > versions > 1 > lessThan 8.3.36
containers > cna > affected > 0 > versions > 1 > versionType semver
containers > cna > affected > 0 > versions > 2 > status affected
containers > cna > affected > 0 > versions > 2 > version 8.4.*
containers > cna > affected > 0 > versions > 2 > lessThan 8.4.27
containers > cna > affected > 0 > versions > 2 > versionType semver
containers > cna > affected > 0 > versions > 3 > status affected
containers > cna > affected > 0 > versions > 3 > version 8.5.*
containers > cna > affected > 0 > versions > 3 > lessThan 8.5.12
containers > cna > affected > 0 > versions > 3 > versionType semver
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
containers > cna > descriptions > 0 > supportingMedia > 0 > type text/html
containers > cna > descriptions > 0 > supportingMedia > 0 > base64 False
containers > cna > descriptions > 0 > supportingMedia > 0 > value PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
containers > cna > references > 0 > url https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
containers > cna > references > 0 > tags > 0 vendor-advisory
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > metrics > 0 > cvssV4_0 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV4_0 > attackComplexity HIGH
containers > cna > metrics > 0 > cvssV4_0 > attackRequirements PRESENT
containers > cna > metrics > 0 > cvssV4_0 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV4_0 > userInteraction NONE
containers > cna > metrics > 0 > cvssV4_0 > vulnConfidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > subConfidentialityImpact NONE
containers > cna > metrics > 0 > cvssV4_0 > vulnIntegrityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > subIntegrityImpact NONE
containers > cna > metrics > 0 > cvssV4_0 > vulnAvailabilityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > subAvailabilityImpact NONE
containers > cna > metrics > 0 > cvssV4_0 > exploitMaturity NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Safety NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Automatable NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Recovery NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > valueDensity NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > vulnerabilityResponseEffort NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > providerUrgency NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > version 4.0
containers > cna > metrics > 0 > cvssV4_0 > baseSeverity CRITICAL
containers > cna > metrics > 0 > cvssV4_0 > baseScore 9.2
containers > cna > metrics > 0 > cvssV4_0 > vectorString CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
containers > cna > workarounds > 0 > lang en
containers > cna > workarounds > 0 > value Check the GitHub Security Advisory for mitigation strategies.
containers > cna > workarounds > 0 > supportingMedia > 0 > type text/html
containers > cna > workarounds > 0 > supportingMedia > 0 > base64 False
containers > cna > workarounds > 0 > supportingMedia > 0 > value Check the GitHub Security Advisory for mitigation strategies.
containers > cna > credits > 0 > lang en
containers > cna > credits > 0 > value Wiz
containers > cna > credits > 0 > type reporter
containers > cna > credits > 1 > lang en
containers > cna > credits > 1 > value Ryan at Calif.io
containers > cna > credits > 1 > type reporter
containers > cna > credits > 2 > lang en
containers > cna > credits > 2 > value OpenAI
containers > cna > credits > 2 > type reporter
containers > cna > credits > 3 > lang en
containers > cna > credits > 3 > value Arnaud Le Blanc
containers > cna > credits > 3 > type remediation developer
containers > cna > credits > 4 > lang en
containers > cna > credits > 4 > value Ilija Tovilo
containers > cna > credits > 4 > type remediation developer
containers > cna > credits > 5 > lang en
containers > cna > credits > 5 > value Jakub Zelenka
containers > cna > credits > 5 > type remediation developer
containers > cna > credits > 6 > lang en
containers > cna > credits > 6 > value Nora Dossche
containers > cna > credits > 6 > type remediation developer
containers > cna > source > discovery UNKNOWN
containers > cna > x_generator > engine Vulnogram 1.0.5
containers > adp > 0 > references > 0 > url https://www.wiz.io/blog/php2shell-php-rce
containers > adp > 0 > references > 0 > tags > 0 third-party-advisory
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-10-21T00:00:00+00:00
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation none
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable no
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-109619
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-10-22T23:04:20.904Z
containers > adp > 1 > title CVE Program Container
containers > adp > 1 > references > 0 > url http://www.openwall.com/lists/oss-security/2026/10/21/7
containers > adp > 1 > references > 1 > url http://www.openwall.com/lists/oss-security/2026/10/21/16
containers > adp > 1 > references > 2 > url http://www.openwall.com/lists/oss-security/2026/10/21/17
containers > adp > 1 > references > 3 > url http://www.openwall.com/lists/oss-security/2026/10/21/23
containers > adp > 1 > references > 4 > url http://www.openwall.com/lists/oss-security/2026/10/22/2
containers > adp > 1 > references > 5 > url http://www.openwall.com/lists/oss-security/2026/10/22/14
containers > adp > 1 > references > 6 > url http://www.openwall.com/lists/oss-security/2026/10/22/15
containers > adp > 1 > references > 7 > url http://www.openwall.com/lists/oss-security/2026/10/22/16
containers > adp > 1 > references > 8 > url http://www.openwall.com/lists/oss-security/2026/10/22/19
containers > adp > 1 > references > 9 > url http://www.openwall.com/lists/oss-security/2026/10/22/20
containers > adp > 1 > references > 10 > url http://www.openwall.com/lists/oss-security/2026/10/23/4
containers > adp > 1 > providerMetadata > orgId af854a3a-2127-422b-91ae-364da2661108
containers > adp > 1 > providerMetadata > shortName CVE
containers > adp > 1 > providerMetadata > dateUpdated 2026-10-23T14:07:57.152Z
containers > adp > 2 > x_adpType supplier
containers > adp > 2 > providerMetadata > orgId 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
containers > adp > 2 > providerMetadata > shortName siemens-SADP
containers > adp > 2 > providerMetadata > dateUpdated 2026-10-23T13:15:15.440Z
containers > adp > 2 > affected > 0 > vendor Siemens
containers > adp > 2 > affected > 0 > product RUGGEDCOM APE1808
containers > adp > 2 > affected > 0 > versions > 0 > status affected
containers > adp > 2 > affected > 0 > versions > 0 > version 0
containers > adp > 2 > affected > 0 > versions > 0 > lessThan *
containers > adp > 2 > affected > 0 > versions > 0 > versionType custom
containers > adp > 2 > affected > 0 > defaultStatus unknown
containers > adp > 2 > references > 0 > url https://cert-portal.siemens.com/productcert/html/ssa-566512.html