PHP Remote Code Execution Vulnerability in PHP Products

CVE-2026-109619

What is CVE-2026-109619?

A vulnerability in PHP allows for the possibility of remote code execution due to improper management of global state that can reference freed memory. In certain scenarios, the global state retains stale information from previous requests, potentially enabling an attacker to execute arbitrary code. This issue arises when the global state does not reset correctly after a request is processed, resulting in the exposure of sensitive memory states to subsequent requests.

News Articles

The Hacker News

CVE-2026-109618CVE-2026-109619

PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

PHP patches two critical RCE flaws affecting web servers as Cloudflare reports early exploit attempts, with no confirmed breaches.

2 hours ago

BleepingComputer

CVE-2026-109618CVE-2026-109619

PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.

2 hours ago

Infosecurity Magazine

CVE-2026-109618CVE-2026-109619

Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patch

Two critical vulnerabilities in PHP were leaked one day before their scheduled disclosure and security patches

6 hours ago

References