CVE-2026-109619: PHP has various global state that temporarily points into request memory

This week

HIGH 8.1REMOTEUPGRADEMITIGATEUPGRADE

CVE-2026-109619 is a high-severity flaw (CVSS 8.1) affecting php, ruggedcom ape1808 firmware, pan-os. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Why this priority

High severity
EPSS top 7%: very likely to be exploited
Public exploit reference
Covered by 11 security sources
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	8.1 (High)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	None
User interaction	None
EPSS exploit chance	6.0% (top 7%)
CISA exploited list	No
Weakness	CWE-416, CWE-755, CWE-824, CWE-1325
Published	2026-10-21
Last modified	2026-10-23

Publisher (CNA): PHP Group · Vendor: paloaltonetworks · php · siemens

Am I affected?

Timeline

2026-10-21 14:17 UTCPublished CVE record published
2026-10-23 16:06 UTCUpdated Record last modified

php php UPGRADE

Affected: >= 5.4.0 and < 8.2.35 · >= 8.3.0 and < 8.3.36 · >= 8.4.0 and < 8.4.27 · >= 8.5.0 and < 8.5.12

Fixed in: 8.2.35, 8.3.36, 8.4.27, 8.5.12

Safe to downgrade to: a release before 5.4.0

1. Check installed version

apt-cache policy php || rpm -q php || php --version

2. UPGRADE to 8.2.35 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade php

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade php

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 5.4.0 (Debian / Ubuntu)

apt-cache madison php sudo apt install php=<VERSION_BEFORE_5.4.0> sudo apt-mark hold php

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list php sudo dnf downgrade php-<VERSION_BEFORE_5.4.0> sudo dnf versionlock add php

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

siemens ruggedcom ape1808 firmware MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

paloaltonetworks pan-os UPGRADE

Affected: >= 10.2.0 and < 10.2.7 · 10.2.7 · 10.2.7 h1 · 10.2.7 h10 · 10.2.7 h11 · 10.2.7 h12 · 10.2.7 h13 · 10.2.7 h14

Fixed in: 10.2.7, 11.1.4, 11.2.4, 12.1.4, 12.2.4

Safe to downgrade to: a release before 10.2.0

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

paloaltonetworks panorama virtual appliance MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy panorama-virtual-appliance || rpm -q panorama-virtual-appliance || panorama-virtual-appliance --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

Fedora 46 · python-openslide · FIXED · 1.4.7-1.fc46 · FEDORA-2026-336bea884e · source

sudo dnf upgrade --advisory=FEDORA-2026-336bea884e

Fedora ELN · valgrind · FIXED · 3.28.0-1.eln159 · FEDORA-2026-c593ef1d15 · source

sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15

Ubuntu 20.04 · php7.4 · FIXED · 7.4.3-4ubuntu2.29+esm5

sudo apt update && sudo apt install --only-upgrade php7.4 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php7.4)" ge "7.4.3-4ubuntu2.29+esm5" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 22.04 · php8.1 · FIXED · 8.1.2-1ubuntu2.28

sudo apt update && sudo apt install --only-upgrade php8.1 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.1)" ge "8.1.2-1ubuntu2.28" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 24.04 · php8.3 · FIXED · 8.3.6-0ubuntu0.24.04.13

sudo apt update && sudo apt install --only-upgrade php8.3 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.3)" ge "8.3.6-0ubuntu0.24.04.13" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · php8.2 · FIXED · 8.2.35-1~deb12u1

sudo apt update && sudo apt install --only-upgrade php8.2 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.2)" ge "8.2.35-1~deb12u1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · php8.4 · FIXED · 8.4.27-1~deb13u1

sudo apt update && sudo apt install --only-upgrade php8.4 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.4)" ge "8.4.27-1~deb13u1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · php · FIXED · php-8.3.36-1.el10_2

sudo dnf upgrade --advisory=RHSA-2026:87070 rpm -q php

RHEL 10 · php8.4 · FIXED · php8.4-8.4.27-1.el10_2

sudo dnf upgrade --advisory=RHSA-2026:87071 rpm -q php8.4

RHEL 10.0 Extended Update Support · php · FIXED · php-8.3.19-1.el10_0.2

sudo dnf upgrade --advisory=RHSA-2026:88561 rpm -q php

RHEL 7 Extended Lifecycle Support · php · FIXED · php-5.4.16-48.el7_9.1

sudo dnf upgrade --advisory=RHSA-2026:88693 rpm -q php

RHEL 9 · php · FIXED · php-8.0.30-8.el9_8.1

sudo dnf upgrade --advisory=RHSA-2026:87151 rpm -q php

Alpine 3.21 · php82 · FIXED · php82-8.2.35-r0

apk add --upgrade php82 apk info -v php82

Alpine 3.22 · php82 · FIXED · php82-8.2.35-r0

apk add --upgrade php82 apk info -v php82

Alpine 3.22 · php83 · FIXED · php83-8.3.36-r0

apk add --upgrade php83 apk info -v php83

Alpine 3.22 · php84 · FIXED · php84-8.4.27-r0

apk add --upgrade php84 apk info -v php84

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-3304 · source

sudo dnf update --advisory=ALAS2023-2026-3304

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: aarsaputra/php2shell (15 stars)
GitHub PoC: unlimit0118/CVE-2026-109619-php2shell-poc (4 stars)
GitHub PoC: cozybear-dev/cve-2026-109619 (4 stars)

Advisories and coverage

Official advisories

Palo Alto Networks: CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH 2026-10-24
Canadian Cyber Centre: AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1 2026-10-23
Cisco Security Advisories: Vulnerabilities in PHP Affecting Cisco Products: October 2026 2026-10-23
Siemens ProductCERT: SSA-566435 V1.0: PHP2Shell Vulnerabilities in Siemens Software Products 2026-10-23
CERT/CC Vulnerability Notes: VU#763488: Memory corruption vulnerabilities in PHP 2026-10-22
HKCERT: PHP Multiple Vulnerabilities 2026-10-22

Research and news

Unit 42 (Palo Alto): Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23) 2026-10-23
Horizon3.ai: CVE-2026-109618 / CVE-2026-109619 | NodeZero Rapid Response Check Now Available 2026-10-23
The Hacker News: PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware 2026-10-23
Security Affairs: PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet 2026-10-23

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

CVE-2026-17544 CRITICAL 9.8 UPGRADE Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PH
CVE-2026-17543 CRITICAL 9.8 UPGRADE Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP
CVE-2026-7260 MEDIUM 5.5 UPGRADE Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashin
CVE-2026-109618 CRITICAL 9.8 UPGRADE MITIGATE PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques
CVE-2026-93682 MEDIUM 5.8 UPGRADE When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value

References

← Back to latest CVEs