CVE-2026-109619 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-21

Added to CISA KEV: 2026-10-26 5 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
CRITICAL — PATCH IMMEDIATELY: Upgrade PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 depending on your branch. This is the only complete remediation.
INCIDENT RESPONSE: Conduct retrospective log analysis for anomalous POST requests targeting session.upload_progress endpoints or other pre-application execution paths. Look for unexpected process spawning from PHP worker processes, file writes to web-accessible directories, or outbound connections from PHP processes.
MITIGATION (if patching is delayed): Disable session.upload_progress in php.ini (session.upload_progress.enabled = Off) to eliminate one known trigger vector.
MITIGATION: Deploy or update WAF rules to detect and block exploit patterns associated with PHP2Shell. Reference Palo Alto Unit 42 and Sansec advisories for specific signatures.
MONITORING: Alert on unexpected child processes spawned by php-fpm or apache2/httpd worker processes. Monitor for web shells written to document roots.
INVENTORY: Identify all PHP versions in your environment immediately. Prioritize internet-facing php-fpm and mod_php deployments as highest risk.
INDUSTRIAL SYSTEMS: Siemens RUGGEDCOM APE1808 operators should consult SSA-566512 immediately for vendor-specific guidance.
PATCH PRIORITY: CRITICAL — treat this as P0 patching. The combination of unauthenticated RCE, massive attack surface, and public researcher knowledge makes this a high-probability exploitation target within days of disclosure.

🔍 Web Intelligence (Kagi · 2026-10-26)

Summary

CVE-2026-109619 is a critical memory safety vulnerability in the PHP scripting language caused by the improper management of global state during request processing ^[7]. Specifically, it involves stale request-owned global state being reused by a later request on the same worker process, which can lead to memory corruption ^[5]. This flaw is particularly significant because it allows for unauthenticated remote code execution (RCE) and is part of a pair of vulnerabilities collectively known as "PHP2Shell" that affect a wide range of PHP versions ^[8]^[9].

Exploitation

Active Exploitation: The vulnerability is being actively tracked as part of the "PHP2Shell" threat landscape; organizations are advised to monitor for signs of compromise given the critical nature of the flaw ^[1].
Threat Actors/Campaigns: While specific attribution to threat actor groups is evolving, the accessibility of the exploit has led to widespread concerns regarding its use in automated campaigns targeting web servers and CMS platforms ^[1].
PoC/Tool Availability: Public research and documentation are available regarding the mechanics of the "PHP2Shell" vulnerabilities, and exploit tools have been reported in the wild following the disclosure ^[4]^[5].
Attack Prerequisites: Exploitation is unauthenticated and remote. It requires reaching the vulnerable code, which can occur on any POST endpoint before application code runs, specifically targeting mechanisms like `session.upload_progress` ^[2]^[3].

Affected Products & Patches

Affected Versions: PHP versions 5.4 through 8.5 are confirmed to be vulnerable ^[8].
Patch Availability: Updates were released by the PHP group on October 21, 2026, to address these vulnerabilities. Organizations should update their PHP installations to the latest patched versions immediately ^[4].
Mitigations: For environments where immediate patching is not possible, organizations should review and disable vulnerable features like `session.upload_progress` or implement rigorous Web Application Firewall (WAF) rules to detect and block malicious POST request patterns associated with this exploit ^[3].

Impact

Access/Capability: Successful exploitation provides an attacker with the ability to execute arbitrary code on the target server with the privileges of the PHP process user ^[2].
Business Risk: Internet-facing deployments are at extreme risk of full system compromise, data theft, and the establishment of persistence for long-term malware deployment. Given the ubiquity of PHP, this vulnerability poses a critical threat to web servers, CMS systems, and various managed services globally ^[1]^[6].

Sources

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026- ...
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. ... CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.
CVE-2026-109619 - Red Hat Customer Portal
CVE Details App An unauthenticated remote attacker can trigger memory corruption leading to potential arbitrary code execution. In typical Red Hat Enterprise Linux deployments, PHP applications exposed to public networks handle incoming requests directly, so no prior authentication is needed to reac…
PHP2Shell: Critical PHP RCE Vulnerabilities CVE-2026 ...
CVE-2026-109619 ("php2shell") targets PHP's session.upload_progress callback, which fires on any POST endpoint before application code runs. The ...
PHP2Shell: PHP RCE (CVE-2026-109618 ...
PHP fixed two remote code execution bugs on October 21. They affect PHP 5.4 and later. An attack needs specific knowledge of the target ...
GitHubphp2shell vulnerabilities (CVE-2026-109618, CVE-2026-109619)
PHP describes CVE-2026-109618 as remote code execution via out-of-memory corruption during request cleanup, and CVE-2026-109619 as remote code execution via stale request-owned global state reused by a later request on the same worker.

🔴 CVE-2026-109619