Details
- Type
- Remote Code Execution
- Impact
- Remote Code Execution
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published
- 21 October 2026
- Updated
- 23 October 2026
- Weakness
- CWE-416
Vendor fix
Update to the latest PHP version with the fix for global state use-after-free.
Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-109619
- https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-109619&date=2026-10-23
- http://www.openwall.com/lists/oss-security/2026/10/21/16
- http://www.openwall.com/lists/oss-security/2026/10/21/17
- http://www.openwall.com/lists/oss-security/2026/10/21/7
- http://www.openwall.com/lists/oss-security/2026/10/22/15
- https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
- https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
- https://www.wiz.io/blog/php2shell-php-rce
- http://www.openwall.com/lists/oss-security/2026/10/22/2
- http://www.openwall.com/lists/oss-security/2026/10/22/16
- http://www.openwall.com/lists/oss-security/2026/10/22/20
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619
- http://www.openwall.com/lists/oss-security/2026/10/21/23
- http://www.openwall.com/lists/oss-security/2026/10/22/14
- http://www.openwall.com/lists/oss-security/2026/10/22/19
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/
- https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618