PHP: Remote code execution via stale global state
Deadline for US federal agencies: 29 Oct 2026
Summary
PHP 8.2 to 8.5 retains global state that can point to memory of a finished request. A fatal error or a nonfatal diagnostic can leave this state set, and a later request handled by the same worker can then use it before initialization. This leads to a use-after-free that can allow unauthenticated remote code execution. Exploitation depends on the affected state, the configuration and the application; the vendor reports demonstrated attacks against Apache mod_php and PHP-FPM.
Affected
- PHP 8.2.* before 8.2.35
- PHP 8.3.* before 8.3.36
- PHP 8.4.* before 8.4.27
- PHP 8.5.* before 8.5.12
- Older branches: unconfirmed, check the vendor advisory and your distribution
Fixed in
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
- Later releases in the same branches
- Distribution packages from your vendor, for example Debian 8.2.35-1~deb12u1 (bookworm) and 8.4.27-1~deb13u1 (trixie)
Workaround
- No complete configuration workaround exists; upgrading is the only reliable mitigation.
- Interim measures reduce exposure only: disable session upload progress and, on PHP 8.5, disable fatal error backtraces, then restart PHP workers.
- Changing error_reporting, using the @ operator or disabling display_errors or log_errors does not protect against this vulnerability.
Exploitation
- CISA SSVC: exploitation active, automatable no, technical impact total.
- CISA KEV entry listed on 2026-10-26 according to the supplied data; not independently verified.
- Public proof-of-concept code is circulating.
- watchTowr reports in-the-wild exploitation of the PHP2Shell vulnerability pair; one third-party analysis attributes the observed chain to CVE-2026-109618 instead.
Our recommendation
- Inventory all PHP installations, including mod_php, PHP-FPM and embedded or bundled PHP.
- Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or a later release in the branch, or install the patched distribution package.
- Replace end-of-life PHP versions (8.1 and older) or obtain vendor backports.
- Apply the interim settings only until the upgrade is complete, and restart PHP workers afterwards.
- Monitor web servers for unusual requests and unexpected processes, and review systems exposed to the internet first.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (24 repositories)
infiniroot/ansible-mitigate-php2shell · santihabib/CVE-2026-109619 · fmdiscioglu/php-cve-2026-109619-checker · unlimit0118/CVE-2026-109619-php2shell-poc · LordX404/php2shell-exploit
Research sources
- GitHub Security Advisory GHSA-6wmf-4rv5-p3rp github.com
- oss-security: PHP security team announcement www.openwall.com
- CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
- watchTowr: PHP RCE PHP2Shell analysis watchtowr.com
- Debian Security Tracker CVE-2026-109619 security-tracker.debian.org
- Datadog Security Labs: PHP2Shell securitylabs.datadoghq.com
- NCSC-NL php2shell wiki github.com
- CERT-EU security advisory 2026-018 cert.europa.eu
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:34.
Original description (NVD)
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
NVD references (19)
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- http://www.openwall.com/lists/oss-security/2026/10/21/16
- http://www.openwall.com/lists/oss-security/2026/10/21/17
- http://www.openwall.com/lists/oss-security/2026/10/21/23
- http://www.openwall.com/lists/oss-security/2026/10/21/7
- http://www.openwall.com/lists/oss-security/2026/10/22/14
- http://www.openwall.com/lists/oss-security/2026/10/22/15
- http://www.openwall.com/lists/oss-security/2026/10/22/16
- http://www.openwall.com/lists/oss-security/2026/10/22/19
- http://www.openwall.com/lists/oss-security/2026/10/22/2
- http://www.openwall.com/lists/oss-security/2026/10/22/20
- http://www.openwall.com/lists/oss-security/2026/10/23/4
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-co…
- https://cert-portal.siemens.com/productcert/html/ssa-166980.html
- https://cert-portal.siemens.com/productcert/html/ssa-566435.html
- https://cert-portal.siemens.com/productcert/html/ssa-566512.html
- https://php2shell.delftintellab.com/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619
- https://www.wiz.io/blog/php2shell-php-rce
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.