{"schemaVersion":3,"id":"CVE-2026-109619","aliases":["DEBIAN-CVE-2026-109619","UBUNTU-CVE-2026-109619","CGA-27r2-77jx-xhhx","CGA-2w55-vwch-54j5","CGA-ch8m-84fg-4f54","CGA-jw53-5px8-8p4j","CGA-m26c-574r-7pj9","CGA-wccj-p34g-9cx7"],"status":"published","duplicateOf":null,"title":null,"description":"PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).","dates":{"published":"2026-10-21T13:54:43.866Z","modified":"2026-10-21T20:08:07.944Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":9.2,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-1419","name":"Incorrect Initialization of Resource","description":"The product attempts to initialize a resource but does not correctly do so, which might leave the resource in an unexpected, incorrect, or insecure state when it is accessed.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1419.html"},{"id":"CWE-416","name":"Use After Free","description":"The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","type":"weakness","status":"Stable","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/416.html"},{"id":"CWE-755","name":"Improper Handling of Exceptional Conditions","description":"The product does not handle or incorrectly handles an exceptional condition.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/755.html"},{"id":"CWE-824","name":"Access of Uninitialized Pointer","description":"The product accesses or uses a pointer that has not been initialized.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/824.html"},{"id":"CWE-1325","name":"Improperly Controlled Sequential Memory Allocation","description":"The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1325.html"}],"affected":[{"vendor":"chainguard","product":"php-8.2","name":"php-8.2","label":"php-8.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/php-8.2","purlType":"apk","versions":[{"text":"< 8.2.34-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.34-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"php-8.3","name":"php-8.3","label":"php-8.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/php-8.3","purlType":"apk","versions":[{"text":"< 8.3.35-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.3.35-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"php-8.4","name":"php-8.4","label":"php-8.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/php-8.4","purlType":"apk","versions":[{"text":"< 8.4.26-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.4.26-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"php-8.5","name":"php-8.5","label":"php-8.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/php-8.5","purlType":"apk","versions":[{"text":"< 8.5.11-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.5.11-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"php-8.2","name":"php-8.2","label":"php-8.2","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/php-8.2","purlType":"apk","versions":[{"text":"< 8.2.34-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.34-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"php-8.3","name":"php-8.3","label":"php-8.3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/php-8.3","purlType":"apk","versions":[{"text":"< 8.3.35-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.3.35-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"php-8.4","name":"php-8.4","label":"php-8.4","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/php-8.4","purlType":"apk","versions":[{"text":"< 8.4.26-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.4.26-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"php-8.5","name":"php-8.5","label":"php-8.5","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/php-8.5","purlType":"apk","versions":[{"text":"< 8.5.11-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.5.11-r4","eol":null,"hubHref":null},{"vendor":"debian","product":"php8.2","name":"php8.2","label":"php8.2","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/php8.2","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 8.2.35-1~deb12u1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 8.2.35-1~deb12u1","eol":null,"hubHref":null},{"vendor":"debian","product":"php8.4","name":"php8.4","label":"php8.4","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/php8.4","purlType":"deb","versions":[{"text":"< 8.4.27-1~deb13u1","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 8.4.27-1~deb13u1 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php5","name":"php5","label":"php5","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php5","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php7.0","name":"php7.0","label":"php7.0","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php7.0","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php7.2","name":"php7.2","label":"php7.2","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php7.2","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php7.4","name":"php7.4","label":"php7.4","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php7.4","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php8.1","name":"php8.1","label":"php8.1","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php8.1","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php8.3","name":"php8.3","label":"php8.3","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php8.3","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php8.5","name":"php8.5","label":"php8.5","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php8.5","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"php group","product":"php","name":"PHP","label":"php","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 8.2.*, < 8.2.35","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.3.*, < 8.3.36","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.4.*, < 8.4.27","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.5.*, < 8.5.12","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 8.2.*, < 8.2.35 | ≥ 8.3.*, < 8.3.36 | ≥ 8.4.*, < 8.4.27 | ≥ 8.5.*, < 8.5.12","eol":null,"hubHref":"/vendor/php_group/php"},{"vendor":"php","product":"php","name":"php","label":"php","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 8.2.35","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.3.0, < 8.3.36","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.4.0, < 8.4.27","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.5.0, < 8.5.12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.35 | ≥ 8.3.0, < 8.3.36 | ≥ 8.4.0, < 8.4.27 | ≥ 8.5.0, < 8.5.12","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"php","label":"PHP","category":"lang"}},"hubHref":"/vendor/php/php"}],"affectedCount":19,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","label":"github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","hostname":"github.com","tags":["Vendor Advisory","Mitigation"]},{"url":"https://www.wiz.io/blog/php2shell-php-rce","label":"www.wiz.io/blog/php2shell-php-rce","hostname":"www.wiz.io","tags":["Third Party Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-109619","label":"security-tracker.debian.org/tracker/CVE-2026-109619","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/21/7","label":"www.openwall.com/lists/oss-security/2026/10/21/7","hostname":"www.openwall.com","tags":[]},{"url":"https://ubuntu.com/security/CVE-2026-109619","label":"ubuntu.com/security/CVE-2026-109619","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109619","label":"www.cve.org/CVERecord?id=CVE-2026-109619","hostname":"www.cve.org","tags":["REPORT"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/21/16","label":"www.openwall.com/lists/oss-security/2026/10/21/16","hostname":"www.openwall.com","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/21/17","label":"www.openwall.com/lists/oss-security/2026/10/21/17","hostname":"www.openwall.com","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/21/23","label":"www.openwall.com/lists/oss-security/2026/10/21/23","hostname":"www.openwall.com","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-21T13:54:43.866Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-21T20:08:07.944Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T22:54:57.746Z","stale":false,"partial":false}}