PHP stale global state remote code execution (CVE-2026-109619)

What happened

The CVE record describes a stale global state condition in which global state temporarily points into request memory. In some scenarios that state is not reset correctly, or is repopulated after being reset, and can still refer to request memory after it is freed. Subsequent requests may read or branch on this stale state before it is fully initialised. Multiple strategies can trigger the condition and produce remote code execution.

The CVSS 4.0 score is 9.2 (critical), with a network attack vector, no privileges and no user interaction; attack complexity is rated high. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 26 October 2026 and lists it as exploited. CISA's due date for required action under BOD 26-04 is 29 October 2026.

Who is affected

PHP is affected across four release lines: 8.2.* before 8.2.35, 8.3.* before 8.3.36, 8.4.* before 8.4.27, and 8.5.* before 8.5.12. Installations using these versions for web applications, APIs or command-line tooling may be affected. The issue sits in PHP itself rather than in a specific application or framework, so exposure depends on where vulnerable PHP builds are reachable from the network.

What to do now

1. Upgrade each affected PHP installation to the matching fixed release: 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
2. Apply CISA's KEV required action: follow BOD 26-04 prioritisation and forensics triage requirements, and discontinue use of the product if mitigations are unavailable.
3. Identify internet-facing systems running the affected PHP versions and restrict network access until patching is complete.

CISA's due date is 29 October 2026. No separate workaround is listed for the underlying flaw.

How to detect it

The CVE record and CISA KEV entry do not list vendor-published indicators of compromise. Start by locating internet-reachable hosts running the affected PHP versions; CISA's required action explicitly calls for evaluation of each asset's internet exposure. Treat any affected PHP instance that accepts network connections as a priority for patching.

Beyond the patch

Patch first, then verify exposure. Because this flaw is reachable over the network without credentials, internet-facing PHP should be treated as an exposure-management issue; Virtual CISO Services can help map which assets are reachable. Because CISA KEV lists the flaw as exploited, detection and response belong in your plan through Managed Detection & Response (MDR).