Vulnerability-Lookup

VA-26-295-01

Vulnerability from csaf_cisa - Published: 2026-10-21 14:56 - Updated: 2026-10-21 14:56

Summary

PHP insecure error handling and state management

Notes

Legal Notice: All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).

Countries and Areas Deployed: Worldwide

Critical Infrastructure Sectors: Information Technology

Risk Evaluation: PHP insecurely handles multiple combinations of memory allocations and error conditions. These behaviors can allow a remote attacker to cause a denial of service or execute arbitrary code. Successful exploitation depends on a number of factors including the specific PHP application being targeted, the SAPI and web server, error handling and memory resource configuration, and platform or OS-level memory protections. Without significant analysis effort to prove otherwise, any application running on a vulnerable version of PHP should be considered vulnerable and exploitable.

Recommended Practices: These vulnerabilities are addressed in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Additional details and mitigations can be found in this PHP advisory: [https://www.php.net/archive/2026.php#2026-10-21-5](https://www.php.net/archive/2026.php#2026-10-21-5) as well as GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.

Company Headquarters Location: United States

CVE-2026-109618

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-755 - Improper Handling of Exceptional Conditions

Affected products

Known affected 4 products

Product	Version	Remediation
PHP php-src <8.2.35 PHP / php-src	<8.2.35	Vendor Fix fix
PHP php-src <8.3.36 PHP / php-src	<8.3.36	Vendor Fix fix
PHP php-src <8.4.27 PHP / php-src	<8.4.27	Vendor Fix fix
PHP php-src <8.5.12 PHP / php-src	<8.5.12	Vendor Fix fix

Fixed 4 products

Product	Version	Remediation
PHP php-src 8.2.35 PHP / php-src	8.2.35	Vendor Fix fix
PHP php-src 8.3.36 PHP / php-src	8.3.36	Vendor Fix fix
PHP php-src 8.4.27 PHP / php-src	8.4.27	Vendor Fix fix
PHP php-src 8.5.12 PHP / php-src	8.5.12	Vendor Fix fix

CVE-2026-109619

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Known affected 4 products, the same list as for CVE-2026-109618

Fixed 4 products, the same list as for CVE-2026-109618

References

7 references

URL	Category
https://raw.githubusercontent.com/cisagov/CSAF/de…	self
https://github.com/php/php-src/security/advisorie…	external
https://www.php.net/archive/2026.php#2026-10-21-5	external
https://raw.githubusercontent.com/cisagov/CSAF/de…	external
https://www.cve.org/CVERecord?id=CVE-2026-109618	external
https://github.com/php/php-src/security/advisorie…	external
https://www.cve.org/CVERecord?id=CVE-2026-109619	external

Acknowledgments

Calif.io Ryan

Wiz

OpenAI

PHP Arnaud Le Blanc

PHP Ilija Tovilo

PHP Jakub Zelenka

PHP Nora Dossche

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries and Areas Deployed"
      },
      {
        "category": "other",
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors"
      },
      {
        "category": "summary",
        "text": "PHP insecurely handles multiple combinations of memory allocations and error conditions. These behaviors can allow a remote attacker to cause a denial of service or execute arbitrary code. Successful exploitation depends on a number of factors including the specific PHP application being targeted, the SAPI and web server, error handling and memory resource configuration, and platform or OS-level memory protections. Without significant analysis effort to prove otherwise, any application running on a vulnerable version of PHP should be considered vulnerable and exploitable.",
        "title": "Risk Evaluation"
      },
      {
        "category": "general",
        "text": "These vulnerabilities are addressed in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Additional details and mitigations can be found in this PHP advisory: [https://www.php.net/archive/2026.php#2026-10-21-5](https://www.php.net/archive/2026.php#2026-10-21-5) as well as GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company Headquarters Location"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerability Advisory VA-26-295-01 CSAF",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-295-01.json"
      }
    ],
    "title": "PHP insecure error handling and state management",
    "tracking": {
      "current_release_date": "2026-10-21T14:56:09Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.15.2+build.155"
        }
      },
      "id": "VA-26-295-01",
      "initial_release_date": "2026-10-21T14:56:09Z",
      "revision_history": [
        {
          "date": "2026-10-21T14:56:09Z",
          "number": "1.0.0",
          "summary": "Initial publication"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "8.2.35",
                "product": {
                  "name": "PHP php-src 8.2.35",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "8.3.36",
                "product": {
                  "name": "PHP php-src 8.3.36",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version",
                "name": "8.4.27",
                "product": {
                  "name": "PHP php-src 8.4.27",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version",
                "name": "8.5.12",
                "product": {
                  "name": "PHP php-src 8.5.12",
                  "product_id": "CSAFPID-0004"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.2.35",
                "product": {
                  "name": "PHP php-src \u003c8.2.35",
                  "product_id": "CSAFPID-0005"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.3.36",
                "product": {
                  "name": "PHP php-src \u003c8.3.36",
                  "product_id": "CSAFPID-0006"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.4.27",
                "product": {
                  "name": "PHP php-src \u003c8.4.27",
                  "product_id": "CSAFPID-0007"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.5.12",
                "product": {
                  "name": "PHP php-src \u003c8.5.12",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "php-src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "8.2.35",
                "product": {
                  "name": "PHP php-src 8.2.35",
                  "product_id": "CSAFPID-0009"
                }
              },
              {
                "category": "product_version",
                "name": "8.3.36",
                "product": {
                  "name": "PHP php-src 8.3.36",
                  "product_id": "CSAFPID-0010"
                }
              },
              {
                "category": "product_version",
                "name": "8.4.27",
                "product": {
                  "name": "PHP php-src 8.4.27",
                  "product_id": "CSAFPID-0011"
                }
              },
              {
                "category": "product_version",
                "name": "8.5.12",
                "product": {
                  "name": "PHP php-src 8.5.12",
                  "product_id": "CSAFPID-0012"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.2.35",
                "product": {
                  "name": "PHP php-src \u003c8.2.35",
                  "product_id": "CSAFPID-0013"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.3.36",
                "product": {
                  "name": "PHP php-src \u003c8.3.36",
                  "product_id": "CSAFPID-0014"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.4.27",
                "product": {
                  "name": "PHP php-src \u003c8.4.27",
                  "product_id": "CSAFPID-0015"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.5.12",
                "product": {
                  "name": "PHP php-src \u003c8.5.12",
                  "product_id": "CSAFPID-0016"
                }
              }
            ],
            "category": "product_name",
            "name": "php-src"
          }
        ],
        "category": "vendor",
        "name": "PHP"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Ryan"
          ],
          "organization": "Calif.io"
        },
        {
          "organization": "Wiz"
        },
        {
          "organization": "OpenAI"
        },
        {
          "names": [
            "Arnaud Le Blanc"
          ],
          "organization": "PHP"
        },
        {
          "names": [
            "Ilija Tovilo"
          ],
          "organization": "PHP"
        },
        {
          "names": [
            "Jakub Zelenka"
          ],
          "organization": "PHP"
        },
        {
          "names": [
            "Nora Dossche"
          ],
          "organization": "PHP"
        }
      ],
      "cve": "CVE-2026-109618",
      "cwe": {
        "id": "CWE-755",
        "name": "Improper Handling of Exceptional Conditions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, the code before the allocation does not properly account for a early exit and leaves reachable request memory in an uninitialized or otherwise invalid state. The request shutdown procedure may then read or branch on the uninitialized memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Application-independent, complete remote code execution has been validated over HTTP against mod_php with default PHP input and memory limits and normal prefork workers. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:T/2026-10-21T14:44:35Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004"
        ],
        "known_affected": [
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        },
        {
          "category": "external",
          "summary": "www.php.net",
          "url": "https://www.php.net/archive/2026.php#2026-10-21-5"
        },
        {
          "category": "external",
          "summary": "VA-26-295-01 CSAF",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-295-01.json"
        },
        {
          "category": "external",
          "summary": "CVE-2026-109618",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109618"
        }
      ],
      "release_date": "2026-10-21T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ],
      "title": "PHP multipart/form-data insecure out-of-memory error handling"
    },
    {
      "acknowledgments": [
        {
          "organization": "Wiz"
        },
        {
          "names": [
            "Ryan"
          ],
          "organization": "Calif.io"
        },
        {
          "organization": "OpenAI"
        },
        {
          "names": [
            "Arnaud Le Blanc"
          ],
          "organization": "PHP"
        },
        {
          "names": [
            "Ilija Tovilo"
          ],
          "organization": "PHP"
        },
        {
          "names": [
            "Jakub Zelenka"
          ],
          "organization": "PHP"
        },
        {
          "names": [
            "Nora Dossche"
          ],
          "organization": "PHP"
        }
      ],
      "cve": "CVE-2026-109619",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "summary",
          "text": "PHP contains error handling, Session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, Session and error handling operations run before normal initialization of the next request. They can trust stale state left by the previous request before initialization has a chance to replace it, causing a use after free. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:T/2026-10-21T14:44:47Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004"
        ],
        "known_affected": [
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        },
        {
          "category": "external",
          "summary": "www.php.net",
          "url": "https://www.php.net/archive/2026.php#2026-10-21-5"
        },
        {
          "category": "external",
          "summary": "VA-26-295-01 CSAF",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-295-01.json"
        },
        {
          "category": "external",
          "summary": "CVE-2026-109619",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-109619"
        }
      ],
      "release_date": "2026-10-21T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        },
        {
          "category": "vendor_fix",
          "date": "2026-10-21T00:00:00Z",
          "details": "Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ],
      "title": "PHP insecure state initialization use-after-free"
    }
  ]
}

CVE-2026-109618 (GCVE-0-2026-109618)

Vulnerability from cvelistv5 – Published: 2026-10-21 13:48 – Updated: 2026-10-21 16:07

Title

RCE via OOM corruption

Summary

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-21 14:34 UTC

CWE

CWE-416 - Use after free
CWE-755 - Improper Handling of Exceptional Conditions
CWE-824 - Access of uninitialized pointer
CWE-1325 - Improperly controlled sequential memory allocation
CWE-1419 - Incorrect Initialization of Resource

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory
https://www.wiz.io/blog/php2shell-php-rce	third-party-advisory
http://www.openwall.com/lists/oss-security/2026/10/21/6

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.35 (semver) Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver)

Credits

Ryan at Calif.io Wiz OpenAI Arnaud Le Blanc Ilija Tovilo Jakub Zelenka Nora Dossche

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109618",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T14:34:39.479770Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T14:36:24.229Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://www.wiz.io/blog/php2shell-php-rce"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-21T16:07:52.535Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "php-src",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.35",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.36",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.27",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.12",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ryan at Calif.io"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Wiz"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "OpenAI"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Arnaud Le Blanc"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ilija Tovilo"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Zelenka"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nora Dossche"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\u003cbr\u003e"
            }
          ],
          "value": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-234",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-234 Hijacking a privileged process"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use after free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755 Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-824",
              "description": "CWE-824 Access of uninitialized pointer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1325",
              "description": "CWE-1325 Improperly controlled sequential memory allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1419",
              "description": "CWE-1419 Incorrect Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T13:48:34.845Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RCE via OOM corruption",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Check the GitHub Security Advisory for mitigation strategies."
            }
          ],
          "value": "Check the GitHub Security Advisory for mitigation strategies."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-109618",
    "datePublished": "2026-10-21T13:48:34.845Z",
    "dateReserved": "2026-10-12T21:03:58.117Z",
    "dateUpdated": "2026-10-21T16:07:52.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109619 (GCVE-0-2026-109619)

Vulnerability from cvelistv5 – Published: 2026-10-21 13:54 – Updated: 2026-10-21 20:08

Title

RCE via stale global state

Summary

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-21 14:34 UTC

CWE

CWE-416 - Use after free
CWE-755 - Improper Handling of Exceptional Conditions
CWE-824 - Access of uninitialized pointer
CWE-1325 - Improperly controlled sequential memory allocation
CWE-1419 - Incorrect Initialization of Resource

Assigner

php CNA under the mitre root

CNA scorecard B 81/100 over 27 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/php/php-src/security/advisorie…	vendor-advisory
https://www.wiz.io/blog/php2shell-php-rce	third-party-advisory
http://www.openwall.com/lists/oss-security/2026/10/21/7
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…
http://www.openwall.com/lists/oss-security/2026/1…

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.2.* , < 8.2.35 (semver) Affected: 8.3.* , < 8.3.36 (semver) Affected: 8.4.* , < 8.4.27 (semver) Affected: 8.5.* , < 8.5.12 (semver)

Credits

Wiz Ryan at Calif.io OpenAI Arnaud Le Blanc Ilija Tovilo Jakub Zelenka Nora Dossche

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109619",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T14:34:42.468059Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T14:36:19.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://www.wiz.io/blog/php2shell-php-rce"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-21T20:08:07.944Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/7"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/16"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/17"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/21/23"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "php-src",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.2.35",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.36",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.4.27",
              "status": "affected",
              "version": "8.4.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.12",
              "status": "affected",
              "version": "8.5.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Wiz"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ryan at Calif.io"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "OpenAI"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Arnaud Le Blanc"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ilija Tovilo"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakub Zelenka"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nora Dossche"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
            }
          ],
          "value": "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-234",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-234 Hijacking a privileged process"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use after free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755 Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-824",
              "description": "CWE-824 Access of uninitialized pointer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1325",
              "description": "CWE-1325 Improperly controlled sequential memory allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1419",
              "description": "CWE-1419 Incorrect Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T13:54:43.866Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RCE via stale global state",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Check the GitHub Security Advisory for mitigation strategies."
            }
          ],
          "value": "Check the GitHub Security Advisory for mitigation strategies."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2026-109619",
    "datePublished": "2026-10-21T13:54:43.866Z",
    "dateReserved": "2026-10-12T21:04:00.504Z",
    "dateUpdated": "2026-10-21T20:08:07.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

VA-26-295-01

CVE-2026-109618 (GCVE-0-2026-109618)

CVE-2026-109619 (GCVE-0-2026-109619)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour