CVE-2026-109619: PHP Global State RCE Vulnerability

CVE-2026-109619 Overview

CVE-2026-109619 is a use-after-free vulnerability [CWE-416] in PHP affecting global state that temporarily references request memory. PHP fails to correctly reset certain global state, or repopulates it after reset, leaving references to request memory after that memory has been freed. Subsequent requests then read or branch on stale state before full initialization. Multiple exploitation strategies can trigger this condition and achieve remote code execution (RCE) against PHP-based web applications.

Critical Impact
Remote attackers can achieve code execution on PHP servers by abusing stale global state references across sequential requests, with public proof-of-concept exploits already published.

Affected Products

PHP (php-src) — multiple versions, see vendor advisory
Web servers running PHP via SAPI (PHP-FPM, mod_php)
Applications and frameworks built on affected PHP runtimes

Discovery Timeline

2026-10-21 - CVE CVE-2026-109619 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-109619

Vulnerability Analysis

The flaw sits in PHP's handling of global state that temporarily points into per-request memory arenas. When a request completes, PHP is expected to clear or reinitialize these pointers before the next request is served. In certain execution paths, the reset either does not occur or is overwritten after it runs, leaving dangling references to memory that has already been freed and potentially reused.

Subsequent requests dereference this stale state during early initialization. Attackers who can influence the layout or contents of the reused heap region can steer execution into attacker-controlled data. The condition is classified as a use-after-free [CWE-416] and is reachable over the network against any SAPI that serves multiple requests from the same worker process.

An EPSS score of 5.76% places this issue in the 93rd percentile for near-term exploitation likelihood, and a public proof of concept is available.

Root Cause

PHP's internal globals keep transient pointers into request-scoped memory for performance. The teardown logic fails to guarantee that every such pointer is cleared, or allows re-population after cleanup. The result is dangling pointers that persist into the next request handled by the same process, violating the lifetime assumption of request-scoped allocations.

Attack Vector

Exploitation requires a network-reachable PHP endpoint and the ability to send sequential requests that are dispatched to the same worker. Attackers send a priming request that leaves the vulnerable global in a stale state, then follow up with a request that triggers access to the freed memory. By controlling allocations between the two requests, attackers can place forged structures where the dangling pointer resolves, leading to RCE.

bash

# Default command execution against target URL
python3 poc_109618.py -u http://127.0.0.1:8088/index.php

# Execute a custom command (max 14 bytes) and verify via local proof file
python3 poc_109618.py -u http://127.0.0.1:8088/index.php -c 'id>/out/p1' --proof-file out/p1

# Execute command writing to webroot and verify via HTTP GET fetch
python3 poc_109618.py -u http://127.0.0.1:8088/index.php -c 'id>p1.txt' --fetch /p1.txt
# Source: https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC

Detection Methods for CVE-2026-109619

Indicators of Compromise

Unexpected child processes spawned by PHP-FPM or web server workers (for example, sh, bash, id, curl, wget).
New or modified files appearing under the web root that were not deployed by legitimate release pipelines.
Short bursts of sequential requests from a single source to the same PHP endpoint followed by anomalous worker behavior.
PHP worker crashes, segmentation faults, or Zend memory manager errors preceding successful exploitation attempts.

Detection Strategies

Alert on PHP SAPI processes (php-fpm, httpd, nginx worker) creating interactive shells or network utilities.
Correlate request logs with worker-process restarts to identify priming-plus-trigger request pairs.
Monitor for writes to webroot paths originating from PHP processes outside of deployment windows.
Review access logs for the PoC request patterns documented in the php2shell PoC repository.

Monitoring Recommendations

Centralize PHP-FPM slow-log and error-log output into SIEM for pattern analysis across workers.
Enable process-execution telemetry on all PHP hosts to capture parent-child relationships from the web server down.
Baseline normal file-write activity under webroot directories and alert on deviations.

How to Mitigate CVE-2026-109619

Immediate Actions Required

Apply the PHP security update referenced in the PHP GitHub Security Advisory GHSA-6wmf-4rv5-p3rp.
Inventory all PHP installations, including container images and bundled runtimes, and upgrade affected versions.
Restart PHP-FPM and web server processes after patching to clear any resident worker state.
Review web and application logs for evidence of exploitation attempts matching the public PoC.

Patch Information

Upstream patches are published through the PHP project. Refer to the PHP GitHub Security Advisory GHSA-6wmf-4rv5-p3rp for fixed version numbers and change references. Additional technical context is available in the Wiz research write-up on PHP RCE and the OpenWall oss-security notice.

Workarounds

Lower pm.max_requests in PHP-FPM so worker processes recycle frequently, reducing the window for cross-request state reuse.
Restrict network exposure of PHP endpoints via WAF rules that rate-limit and inspect sequential requests to the same URI from a single source.
Where feasible, isolate PHP workloads in dedicated containers so a compromised worker cannot pivot to shared infrastructure.