CVE-2026-109619: PHP use-after-free in global state handling

CVE-2026-109619 · Severity: critical · Exploited in the wild · Published 2026-10-21

PHP is a server-side programming language used to build websites and web applications. A flaw in how PHP manages internal memory state across requests allows an attacker to execute arbitrary code on the server. The vulnerability requires PHP to be running in certain worker configurations (like Apache mod_php) and involves crafting specific requests that trigger memory cleanup errors.

Technologies: PHP Group PHP. Vendors: PHP Group.

Quick answers

Is CVE-2026-109619 exploited in the wild?
Yes. CVE-2026-109619 is known to be exploited in the wild, first recorded on 26 October 2026. Treat it as urgent.
How severe is CVE-2026-109619?
Critical severity, published 21 October 2026.
Which products and versions are affected?
PHP Group PHP < 8.2.35, < 8.3.36, < 8.4.27, < 8.5.12.
Is there a fix for CVE-2026-109619?
Yes: fixed in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12. Until then: Ensure PHP is configured with explicit, valid INI settings to avoid early diagnostic warnings during request initialization. Validate memory_limit, date.timezone, and encoding settings (.htaccess, php.ini, or FPM configuration). For Apache mod_php, review .htaccess and php_value directives that may trigger deprecated or invalid settings. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109619 attacked?
It is attacked over the network.
Am I affected by CVE-2026-109619?
Check whether you run PHP Group PHP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12

Ensure PHP is configured with explicit, valid INI settings to avoid early diagnostic warnings during request initialization. Validate memory_limit, date.timezone, and encoding settings (.htaccess, php.ini, or FPM configuration). For Apache mod_php, review .htaccess and php_value directives that may trigger deprecated or invalid settings.

Technical details

PHP's worker processes maintain global state that points into request-owned memory. When certain fatal errors or memory exhaustion occur, state reset operations are skipped or repopulated after being cleared, leaving dangling pointers into freed request heap. A subsequent request handled by the same worker can trigger operations (such as INI diagnostics) that access this stale state before normal initialization, resulting in use-after-free. With a crafted heap layout, this enables remote code execution; the attack requires both a "producer" operation that leaves state unreset and a "consumer" operation in a different request that acts on the stale pointer.

Affected products

  • PHP Group PHP < 8.2.35, < 8.3.36, < 8.4.27, < 8.5.12

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.