Protego field desk
PROTEGO
← CVE Lookup

CVE-2026-109619

CRITICALCVSS 4.0 · 9.2 · security@php.net

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CISA KEV: known exploited

Added: 2026-10-26 · Due: 2026-10-29

Known ransomware use: Unknown

EPSS: 100.00% · Percentile: 100.0%

As of 2026-10-27

EPSS estimates exploitation probability over the next 30 days. KEV due dates apply to US federal civilian agencies. Confirm your affected versions in vendor advisories.

CWE: CWE-416, CWE-755, CWE-824, CWE-1325 · Published: 2026-10-21T14:17:09.823 · Modified: 2026-10-27T13:43:34.837

Our patch guide: PHP2Shell patch guide →

Sources: NIST NVD, CISA KEV, FIRST EPSS. NVD and EPSS cached up to 6 hours; KEV up to 12 hours.

All CVSS assessments
  • CVSS 4.0: 9.2 (CRITICAL) · security@php.net
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • CVSS 3.1: 8.1 (HIGH) · NIST NVD
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References and fixes