Source · cve · primary · captured

CVE-2026-109619: RCE via stale global state

CVE Program (CNA: PHP Group) · https://www.cve.org/CVERecord?id=CVE-2026-109619 · published 2026-10-21T13:54:43.866Z · added by collector-primary · slug cve-cve-2026-109619

CVE record JSON in raw/. dateReserved 2026-10-12T21:04:00Z, datePublished 2026-10-21T13:54:43Z, dateUpdated 2026-10-22T08:09:24Z (updated minutes before our fetch; CVE Program container lists oss-security refs incl. 22/2). CISA ADP SSVC: Exploitation none.

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026…2026-10-12 21:03:58 UTC: CVE-2026-109618 and CVE-2026-1096…2026-10-21 13:48:34 UTC: The CVE record for CVE-2026-10961…2026-10-21 14:34 UTC: CISA's ADP assessment on both CVE re…9.2 CVSS v4.0, each CVECVE record

What it says, as the collector read it

CVE-2026-109619 (cve.org record): notes

  • Captured 08:12Z; raw/cveawg-api.json fetched 08:11Z.
  • CNA PHP Group. Title "RCE via stale global state".
  • Description (verbatim): "PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE)."
  • Affected ranges identical to 109618 (8.2 <8.2.35, 8.3 <8.3.36, 8.4 <8.4.27, 8.5 <8.5.12). CVSS v4.0 9.2, same vector.
  • Reserved 2026-10-12T21:04:00Z; published 2026-10-21T13:54:43Z; updated 2026-10-22T08:09:24Z.
  • CISA ADP SSVC 14:34:42Z: Exploitation "none". CVE Program container references oss-security 2026/10/21/7, /16, /17, /23, 2026/10/22/2.
  • Same 7.4-8.1 caveat as 109618.

Claims that cite it

ClaimWho says itStatusPrimarySources
Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35PHP Group (CNA), GitHub advisories, php.netconfirmed5/5CVE record CVE record PHP PHP php.net

Events that cite it

WhenEventTime is
2026-10-12 21:03:58 UTCCVE-2026-109618 and CVE-2026-109619 are reserved.stated
2026-10-21 13:48:34 UTCThe CVE record for CVE-2026-109618 is published; CVE-2026-109619 follows at 13:54:43Z.stated
2026-10-21 14:34 UTCCISA's ADP assessment on both CVE records: exploitation none, automatable no, technical impact total.stated

Numbers from this source

FigureOfStatus
9.2CVSS v4.0, each CVEconfirmed

Exploitation signals from this source

The bytes

capture 20261022T081219Z · HTTP 200 · https://www.cve.org/CVERecord?id=CVE-2026-109619
  • headers.json 03c46200ee6c4d6c0d0a06fdaae6fb0a376986fa48431cdc5543e5ae073ca8f7 1,500 bytes
  • page.html a112001fc560b257188b1628cf8f547b421b7bb934cbd574254375a26151ab50 880 bytes
  • provenance.json 7de30cfb3eb2de89b08dcd062e6eee6c14efb0710ba248992dd2c1e2d3636335 952 bytes
  • rendered.html 83e446fe17d5717ad7f281973b506b4ba9e19b1b7cec8a4687132cd84419c71f 150,334 bytes
  • screenshot.png ae02d0aca995d93891d5bc181141c569b6b465a32272d727709884750ecdb50b 367,927 bytes
  • text.txt 3162135e82a9edd4b3ce352b41d2ecc34275ee0bb55a6444ed40c2146f1566c5 3,351 bytes
raw, 1 files with SHA256SUMS
  • cveawg-api.json d045248b93425b1a6f5a0fc29ae36b5cfcd3c8188d969664a0d8e5f82ff05f61

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →