CVE-2026-109619

RCE via stale global state

Publication Date 2026-08-24
Severity Critical
Type Remote Code Execution
Affected PHP Versions
  • 7.2.0-7.3.34
  • 7.3.0-7.3.33
  • 7.4.0-7.4.33
  • 8.1.0-8.1.34
  • 8.2.0-8.2.34
  • 8.3.0-8.3.35
  • 8.4.0-8.4.26
  • 8.5.0-8.5.11
Fixed Product Versions
  • ZendPHP 7.2
  • ZendPHP 7.3
  • ZendPHP 7.4
  • ZendPHP 8.1
  • ZendPHP 8.2
  • ZendPHP 8.3
  • ZendPHP 8.4
  • ZendPHP 8.5
  • ZendServer 2021.4.9

CVE Details

PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, session and error handling operations run before normal initialization of the next request. They inadvertently access stale state not reset by the previous request before initialization has a chance to replace it, causing a use after free. A strategically crafted heap layout can produce full remote code execution (RCE).

This vulnerability affects all PHP 5, PHP 7, and PHP 8.0 and 8.1 versions, as well as the listed PHP 8 versions in this disclosure.

Recommendations

Updating to a PHP release containing the patch to this vulnerability is the only complete mitigation.

Several other mitigations can be made to help prevent issues until you can patch; however do not consider these as complete solutions, and update to a patched version as soon as possible:

  • Disable the PHP 8.5 fatal_error_backtraces setting.
  • Disable session.upload_progress.enabled
  • If possible, use a reverse proxy or Web Application Firewall (WAF) to rate limit or disable multi-part uploads where they are not needed/accepted on your site.
  • Use AppArmor or SELinux to restrict PHP's access to system binaries if possible.