Source · advisory · primary · captured

CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

oss-security list (Jakub Zelenka, PHP security team) · https://www.openwall.com/lists/oss-security/2026/10/21/7 · published 2026-10-21T14:44:06Z · added by collector-primary · slug openwall-oss-security-2026-10-21-7

Date header Wed, 21 Oct 2026 16:44:06 +0200. Replies at 21/16, 21/17, 21/23, 22/2 are in openwall-oss-security-109619-thread.

Updating is the only complete mitigation; the configuratio…2026-10-21 14:41:54 UTC: Jakub Zelenka announces CVE-2026-…oss-security

What it says, as the collector read it

oss-security 2026/10/21/7: notes

  • From Jakub Zelenka. Date 21 Oct 2026 16:44:06 +0200 = 14:44:06Z. (A reply at 21/16 quotes it as sent "10:11 AM" -0500 = 15:11Z. The quoted time does not match the Date header; it may be the reply client's own receive or display time.)
  • Verbatim: "CVE: CVE-2026-109619 / Severity: Critical (CVSS v4.0: 9.2)", same affected ranges.
  • "Unauthenticated RCE has been demonstrated against Apache mod_php and PHP-FPM. Exploitability depends on the affected state, configuration, and application behavior."
  • "Updating is the only reliable mitigation; there is no complete generic configuration workaround."

Claims that cite it

ClaimWho says itStatusPrimarySources
Updating is the only complete mitigation; the configuration measures reduce exposure to specific paths and do not make an installation safephp.net; PHP security teamconfirmed3/3php.net oss-security PHP

Events that cite it

WhenEventTime is
2026-10-21 14:41:54 UTCJakub Zelenka announces CVE-2026-109618 on oss-security; CVE-2026-109619 at 14:44:06Z.stated

The bytes

capture 20261022T081407Z · HTTP 200 · https://www.openwall.com/lists/oss-security/2026/10/21/7
  • headers.json ffb76440772a63ed2186c00ea575b6e673ca3c7222ae89205c2bbb9de07e38ae 239 bytes
  • page.html 81caae4759a5e9cd8e501221e12f31928874e9d16d7f7e8523e8cb1d36aa69fd 6,323 bytes
  • provenance.json deeabe8cb21005c2d60c6ffcca6537969877e4411a8d1bbc88503109265756ce 1,028 bytes
  • rendered.html b797761c288a2b59dad8b9bf3c0f4810af1b669a685b93013a7d6edc0e688638 6,579 bytes
  • screenshot.png d6c5ab360073ebc5769973dc76493c74acf62cdc6e099f668ebffae91de551fa 154,322 bytes
  • text.txt ceef70b4943f78182c26af1c04cdac8a7986a9c2c5f5cbb5385a73efdd112384 1,934 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →