VULNERABILITY INTELLIGENCE

CVE-2026-109619

CVSS score9.2 CRITICAL
EPSS probability100.00%
CISA KEVKnown exploited vulnerability
Published2026-10-21
Last modified2026-10-30
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Known Exploited Vulnerability

PHP Stale Internal Request-State Vulnerability

Vendor / product: PHP Group / PHP

Description

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Weakness classification

  • CWE-416: Use After Free
  • CWE-755: Improper Handling of Exceptional Conditions
  • CWE-824: Access of Uninitialized Pointer
  • CWE-1325: Improperly Controlled Sequential Memory Allocation

Primary references