Skip to content
Fencer Vulns
high 8.1

CVE-2026-109619 kev in the critical feed json

RCE via stale global state

published 2026-10-21 18 d ago modified 2026-11-05 3 d ago also BIT-libphp-2026-109619 , BIT-php-2026-109619 , BIT-php-min-2026-109619 , EUVD-2026-107265 , GHSA-6wmf-4rv5-p3rp

cvss
8.1
version 3.1, NVD
cisa kev
Exploited
added 2026-10-26
epss
100.0%
EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
public exploits
0
none known, plus a Nuclei check

Summary

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Patch / fix

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

  • bitnami libphp 8.2.35, 8.3.36, 8.4.27, 8.5.12
  • bitnami php 8.2.35, 8.3.36, 8.4.27, 8.5.12
  • bitnami php-min 8.2.35, 8.3.36, 8.4.27, 8.5.12
  • PHP Group PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12
  • Siemens Local Monitoring bt-monitoring-vm V20261103
  • php8.2 Debian 12 8.2.35-1~deb12u1
  • php8.4 Debian 13 8.4.27-1~deb13u1
  • php8.4 Debian 14 8.4.27-1

debian advisories DEBIAN-CVE-2026-109619

  • php8.1 Ubuntu 22.04 LTS 8.1.2-1ubuntu2.28
  • php8.3 Ubuntu 24.04 LTS 8.3.6-0ubuntu0.24.04.13
  • php8.5 Ubuntu 26.10 8.5.9-0ubuntu2.1
  • php8.5 Ubuntu 26.04 LTS 8.5.4-0ubuntu1.5
  • php5 Ubuntu Pro 14.04 LTS 5.5.9+dfsg-1ubuntu4.29+esm18
  • php7.0 Ubuntu Pro 16.04 LTS 7.0.33-0ubuntu0.16.04.16+esm22
  • php7.2 Ubuntu Pro 18.04 LTS 7.2.24-0ubuntu0.18.04.17+esm14
  • php7.4 Ubuntu Pro 20.04 LTS 7.4.3-4ubuntu2.29+esm5

ubuntu advisories UBUNTU-CVE-2026-109619

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • php74 SLE Module for Web and Scripting 12 7.4.33-1.74.1
  • php7 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +7 more 7.4.33-150400.4.81.1
  • php7-fpm SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +6 more 7.4.33-150400.4.81.1
  • php7-test SLE Module for Package Hub 15 SP7 7.4.33-150400.4.81.2
  • php7-embed SLE Module for Package Hub 15 SP7 7.4.33-150400.4.81.1
  • php7-fastcgi SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +6 more 7.4.33-150400.4.81.1
  • apache2-mod_php7 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +7 more 7.4.33-150400.4.81.1
  • php8 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 8.0.30-150400.4.80.1

suse advisories SUSE-SU-2026:4870-1SUSE-SU-2026:4853-1SUSE-SU-2026:4852-1SUSE-SU-2026:24271-1SUSE-SU-2026:4844-1SUSE-SU-2026:4843-1

  • php8 openSUSE Leap 16.0 8.4.27-160000.1.1
  • php8-fpm openSUSE Leap 16.0 8.4.27-160000.1.1
  • php8-test openSUSE Leap 16.0 8.4.27-160000.1.1
  • php8-embed openSUSE Leap 16.0 8.4.27-160000.1.1
  • php8-fastcgi openSUSE Leap 16.0 8.4.27-160000.1.1
  • apache2-mod_php8 openSUSE Leap 16.0 8.4.27-160000.1.1
  • php8 openSUSE Tumbleweed 8.5.12-1.1

opensuse advisories openSUSE-SU-2026:22151-1openSUSE-SU-2026:12219-1

  • php AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-gd AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-cli AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-dba AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-dbg AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-fpm AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-gmp AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1
  • php-pdo AlmaLinux 8 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1

almalinux advisories ALSA-2026:A011ALSA-2026:A012ALSA-2026:A013ALSA-2026:A014ALSA-2026:87070ALSA-2026:87071

  • php Rocky Linux 8 8.2.35-1.module+el8.10.0+40394+d21b33fb
  • libzip Rocky Linux 8 1.7.3-1.module+el8.10.0+1605+02e07af7
  • libzip Rocky Linux 8 1.7.3-1.module+el8.10.0+1596+477f03f8
  • libzip Rocky Linux 8 1.7.3-1.module+el8.10.0+1911+f499711e
  • php-pear Rocky Linux 8 1:1.10.14-1.module+el8.10.0+1911+f499711e
  • php-pear Rocky Linux 8 1:1.10.14-1.module+el8.10.0+1596+477f03f8
  • php-pecl-rrd Rocky Linux 8 2.0.3-1.module+el8.10.0+1911+f499711e
  • php-pecl-rrd Rocky Linux 8 2.0.3-1.module+el8.10.0+1596+477f03f8

rocky linux advisories RLSA-2026:87073RLSA-2026:87070RLSA-2026:87071RLSA-2026:87072RLSA-2026:87079RLSA-2026:87151

  • php82 Alpine 3.22, Alpine 3.21 8.2.35-r0
  • php83 Alpine 3.24, Alpine 3.23, Alpine 3.22 8.3.36-r0
  • php84 Alpine 3.24, Alpine 3.23, Alpine 3.22 8.4.27-r0
  • php85 Alpine 3.24, Alpine 3.23 8.5.12-r0

alpine advisories ALPINE-CVE-2026-109619

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • php Azure Linux 3.0 8.3.35-2
  • php-cli Azure Linux 3.0 8.3.35-2

azure linux advisories AZL-109818AZL-112312

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • php Arch Linux 8.5.12-1
  • php-legacy Arch Linux 8.3.36-1

arch linux advisories AVG-2909AVG-2910

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-109619 updated cvss 8.1

php: fatal error handling retains stale request state leading to use-after-free

  • Red Hat Enterprise Linux 6 php, php-gd, php-cli, php-dba, php-fpm, php-pdo, +20 more
    affected: workaround, no fix planned “See the security bulletin for a detailed mitigation procedure.”
  • Red Hat Enterprise Linux 9 php, php-gd, php-cli, php-dba, php-dbg, php-ffi, +18 more
    affected: workaround, no fix available “See the security bulletin for a detailed mitigation procedure.”
  • Red Hat Enterprise Linux AppStream (v. 8) php 7.4.33-8.module+el8.10.0+25117+30337cca, php 8.2.35-1.module+el8.10.0+25110+f67151d2, libzip 1.6.1-1.module+el8.10.0+22485+a3539972, libzip 1.7.3-1.module+el8.10.0+20770+a5eca186, php-gd 7.4.33-8.module+el8.10.0+25117+30337cca, php-gd 8.2.35-1.module+el8.10.0+25110+f67151d2, +60 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:87080
  • Red Hat Enterprise Linux AppStream (v. 9) php 8.0.30-8.el9_8.1, php-gd 8.0.30-8.el9_8.1, php-cli 8.0.30-8.el9_8.1, php-dba 8.0.30-8.el9_8.1, php-dbg 8.0.30-8.el9_8.1, php-ffi 8.0.30-8.el9_8.1, +77 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:87072
  • Red Hat Enterprise Linux AppStream (v. 10) php 8.3.36-1.el10_2, php-gd 8.3.36-1.el10_2, php8.4 8.4.27-1.el10_2, php-cli 8.3.36-1.el10_2, php-dba 8.3.36-1.el10_2, php-dbg 8.3.36-1.el10_2, +42 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:87070
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-gd 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-cli 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-dba 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-dbg 7.4.6-5.module+el8.4.0+25156+e0c98721.3, +28 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88565
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, php-gd 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, apcu-panel 5.1.18-1.module+el8.3.0+6678+b09f589e, php-cli 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, php-dba 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, +28 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88533
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, php-gd 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, apcu-panel 5.1.18-1.module+el8.3.0+6678+b09f589e, php-cli 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, php-dba 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, +28 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88532
show 11 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) php 8.0.30-1.el9_2.2, php-gd 8.0.30-1.el9_2.2, php-cli 8.0.30-1.el9_2.2, php-dba 8.0.30-1.el9_2.2, php-dbg 8.0.30-1.el9_2.2, php-ffi 8.0.30-1.el9_2.2, +18 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88659
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) php 8.0.30-1.el9_4.2, php-gd 8.0.30-1.el9_4.2, php-cli 8.0.30-1.el9_4.2, php-dba 8.0.30-1.el9_4.2, php-dbg 8.0.30-1.el9_4.2, php-ffi 8.0.30-1.el9_4.2, +47 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88835
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) php 8.3.19-1.el10_0.2, php-gd 8.3.19-1.el10_0.2, php-cli 8.3.19-1.el10_0.2, php-dba 8.3.19-1.el10_0.2, php-dbg 8.3.19-1.el10_0.2, php-ffi 8.3.19-1.el10_0.2, +18 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88561
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) php 8.0.30-3.el9_6.2, php-gd 8.0.30-3.el9_6.2, php-cli 8.0.30-3.el9_6.2, php-dba 8.0.30-3.el9_6.2, php-dbg 8.0.30-3.el9_6.2, php-ffi 8.0.30-3.el9_6.2, +77 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88834
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-gd 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-cli 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-dba 7.4.6-5.module+el8.4.0+25156+e0c98721.3, php-dbg 7.4.6-5.module+el8.4.0+25156+e0c98721.3, +28 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88565
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, php-gd 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, apcu-panel 5.1.18-1.module+el8.3.0+6678+b09f589e, php-cli 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, php-dba 7.4.19-4.module+el8.6.0+25157+c2ff122e.3, +28 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88533
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) libzip 1.6.1-1.module+el8.3.0+6678+b09f589e, php 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, php-gd 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, apcu-panel 5.1.18-1.module+el8.3.0+6678+b09f589e, php-cli 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, php-dba 7.4.33-1.module+el8.8.0+25148+55cf9df9.2, +28 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88532
  • Red Hat Enterprise Linux Server (v. 7 ELS) php 5.4.16-48.el7_9.1, php-cli 5.4.16-48.el7_9.1 Red Hat Enterprise Linux Server Optional (v. 7 ELS) php-fpm 5.4.16-48.el7_9.1, php-embedded 5.4.16-48.el7_9.1
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:88693
  • Red Hat Hardened Images php 8.5.12-1.hum1, php-gd 8.5.12-1.hum1, php-cli 8.5.12-1.hum1, php-dba 8.5.12-1.hum1, php-dbg 8.5.12-1.hum1, php-ffi 8.5.12-1.hum1, +21 more
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:87414
  • Red Hat OpenShift Dev Spaces 3.31 devspaces/udi-rhel9 1792708612
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:90321
  • Red Hat Enterprise Linux Server (v. 7 ELS) php-gd 5.4.16-48.el7_9.1, php-pdo 5.4.16-48.el7_9.1, php-xml 5.4.16-48.el7_9.1, php-ldap 5.4.16-48.el7_9.1, php-odbc 5.4.16-48.el7_9.1, php-soap 5.4.16-48.el7_9.1, +6 more Red Hat Enterprise Linux Server Optional (v. 7 ELS) php-dba 5.4.16-48.el7_9.1, php-intl 5.4.16-48.el7_9.1, php-snmp 5.4.16-48.el7_9.1, php-bcmath 5.4.16-48.el7_9.1, php-pspell 5.4.16-48.el7_9.1, php-enchant 5.4.16-48.el7_9.1, +2 more Red Hat OpenShift AI (RHOAI) rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Dev Spaces devspaces/code-rhel9 Red Hat OpenShift Dev Spaces 3.31 devspaces/code-rhel9 1792599388, devspaces/server-rhel9 1792775639, devspaces/openvsx-rhel9 1792494821, devspaces/traefik-rhel9 1792464177, devspaces/udi-base-rhel9 1792686842, devspaces/code-sshd-rhel9 1792598059, +9 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa vex VA-26-295-01 updated cvss 8.1

PHP insecure error handling and state management

  • php-src <8.2.35, <8.3.36, <8.4.27, <8.5.12
    affected: vendor fix github.com
  • php-src 8.2.35, 8.3.36, 8.4.27, 8.5.12
    fixed: vendor fix github.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. CISA SSVC: exploitation active
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline

Known exploited

Added
14 d ago
Patch by
2026-10-29 (11 d ago)
Ransomware
Not known
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Vendor, product
PHP Group, PHP
CISA name
PHP Stale Internal Request-State Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
19 d ago

Exploit prediction

100.00% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 - Use-After-Free Remote Code Execution nuclei detection template

CVSS scores

assigned by version score vector
CNA 4.0 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami libphp
>=5.4.0, <8.2.35
>=8.3.0, <8.3.36
>=8.4.0, <8.4.27
>=8.5.0, <8.5.12
8.2.35
8.3.36
8.4.27
8.5.12
bitnami php
>=5.4.0, <8.2.35
>=8.3.0, <8.3.36
>=8.4.0, <8.4.27
>=8.5.0, <8.5.12
8.2.35
8.3.36
8.4.27
8.5.12
bitnami php-min
>=5.4.0, <8.2.35
>=8.3.0, <8.3.36
>=8.4.0, <8.4.27
>=8.5.0, <8.5.12
8.2.35
8.3.36
8.4.27
8.5.12

Affected products

  • PHP Group PHP
  • Siemens AMIS TS
  • Siemens AX4
  • Siemens blueplanet 360 NX3 M6 WM OD IISX
  • Siemens blueplanet 360 NX3 M6 WM OD IISX - S
  • Siemens Building X
  • Siemens CADRA
  • Siemens Call stations
  • Siemens Capital
  • Siemens Chargesight
  • Siemens Climatix Cloud IC
  • Siemens Climatix Devices
  • Siemens Connect Insights
  • Siemens Connect X200
  • Siemens Connect X300
  • Siemens Connect X500
  • Siemens cRSP
  • Siemens Depotfinity
  • Siemens Designcenter
  • Siemens Designcenter X
  • Siemens Designcenter X Essentials
  • Siemens Desigo CC
  • Siemens Desigo DXR2
  • Siemens Desigo DXR3
  • Siemens Desigo Optic
  • Siemens Desigo PXC3
  • Siemens Desigo PXC4
  • Siemens Desigo PXC5
  • Siemens Desigo PXC7
  • Siemens DFMExpress
  • Siemens Energy Engage V2.0SP9
  • Siemens Energy Engage V3.1SP1
  • Siemens Energy Management System
  • Siemens Enlighted RTLS
  • Siemens Enlighted Space
  • Siemens Heliox Flex Pro
  • Siemens Heliox H60
  • Siemens Heliox Rapid
  • Siemens HyperLynx
  • Siemens Insights Hub
  • Siemens Local Monitoring bt-monitoring-vm
  • Siemens Navigator E&S
  • Siemens Novigo VANSYS
  • Siemens Novigo VANSYS core
  • Siemens Opcenter Connect Electronics
  • Siemens Opcenter Connect MOM
  • Siemens Opcenter Execution Core
  • Siemens Opcenter Execution Discrete
  • Siemens Opcenter Execution Foundation
  • Siemens Opcenter Execution Pharma

Classification

Weakness
  • CWE-416 Use After Free
  • CWE-755 Improper Handling of Exceptional Conditions
  • CWE-824 Access of Uninitialized Pointer
  • CWE-1325 Improperly Controlled Sequential Memory Allocation
  • CWE-1419 Incorrect Initialization of Resource
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of php/php-src published their own advisory on GitHub. Reviewed sources take precedence over it.