PHP Remote Code Execution Vulnerability

PHP

What happened

A vulnerability in PHP allows potential remote code execution due to improper handling of global state that may reference freed memory. This can result in subsequent requests operating on stale data before it is properly initialized.

Are you affected?

PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are affected.

What to do now

1. Upgrade PHP to version 8.2.35 or later, 8.3.36 or later, 8.4.27 or later, or 8.5.12 or later.
2. Review applications for any dependency on affected PHP environments and ensure proper versioning.

Sources

• cve.now/CVE-2026-109619
• CVE-2026-109619
• https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-109619.yaml
• https://github.com/1Nightlovel/CVE-2026-109619
• https://github.com/DarynOngera/solid-palm-tree
• https://github.com/EQSTLab/CVE-2026-109619
• https://github.com/FarhadHosen101/PHP2Shell-CVE-2026-109619
• https://github.com/K2uci/PHP2ShellPOC-CVE-2026-109619
• https://github.com/LordX404/php2shell-exploit
• https://github.com/MorphingYU/CVE-2026-109619
• https://github.com/Prajjwal-Srivastava/php2shell_scanner
• https://github.com/RuanSerraAzul/CVE-2026-109619-POC
• https://github.com/Taz1920/cve-2026-109619
• https://github.com/WallcroftUK/CVE-2026-109619
• https://github.com/aarsaputra/php2shell
• https://github.com/abraxas/php-stale-global-uaf
• https://github.com/baimaobg/php-cve-2026-109619-lab
• https://github.com/basesixtythree/B63-POC-CVE-2026-109619
• https://github.com/cozybear-dev/cve-2026-109619
• https://github.com/dev-maple/php2shell-CVE-2026-109619
• https://github.com/fellipgomes/br-php2shell
• https://github.com/fmdiscioglu/php-cve-2026-109619-checker
• https://github.com/infiniroot/ansible-mitigate-php2shell
• https://github.com/mazdel/php2shell-poc
• https://github.com/santihabib/CVE-2026-109619
• https://github.com/solidevil14/php2shell-detections
• https://github.com/syrex1013/CVE-2026-109619
• https://github.com/unlimit0118/CVE-2026-109619-php2shell-poc

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.