PHP Remote Code Execution Vulnerability in PHP Products
CVE-2026-109619

9.2CRITICAL

Key Information:

Vendor: PHP Group
Status: PHP
Vendor: CVE Published:; 21 October 2026

Badges

📈 Score: 354👾 Exploit Exists🟡 Public PoC🟣 EPSS 99%🦅 CISA Reported📰 News Worthy

What is CVE-2026-109619?

CVE-2026-109619 is a serious vulnerability affecting PHP products that can lead to remote code execution (RCE). PHP, a widely utilized scripting language primarily for web development, manages a global state that temporarily points to request memory during its operation. In certain circumstances, this global state may fail to reset correctly or may be erroneously repopulated after being reset. Consequently, the system may reference freed memory in subsequent requests, which could result in the execution of arbitrary code by an attacker. This flaw poses a significant threat to organizations using PHP, as it could allow malicious actors to exploit the vulnerability and gain unauthorized access to systems, potentially compromising sensitive information and disrupting services.

Potential Impact of CVE-2026-109619

Remote Code Execution: This vulnerability allows attackers to execute arbitrary code on the affected systems, granting them the ability to manipulate operations, access sensitive data, and maintain persistent control over compromised servers.
Data Breaches: The RCE capabilities offered by this vulnerability can lead to unauthorized access to confidential information, resulting in significant financial and reputational damage for organizations. This can include theft of user data, intellectual property, and sensitive operational data.
Service Disruption: Exploitation of this vulnerability can compromise the integrity of web applications and services, leading to downtime or degradation of service reliability. Such disruption can affect user trust and customer satisfaction, ultimately impacting business operations.

CISA has reported CVE-2026-109619

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-109619 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

PHP 8.2.* < 8.2.35

PHP 8.3.* < 8.3.36

PHP 8.4.* < 8.4.27

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

php2shell
Created by aarsaputra

solid-palm-tree
Created by DarynOngera

php2shell-exploit
Created by LordX404