CVE-2026-109619: PHP Stale Request State Use-After-Free Allows Unauthenticated RCE

Background

CVE-2026-109619 is the second half of the “php2shell” disclosure of October 21, 2026, alongside CVE-2026-109618 (OOM corruption), which has its own Vuln Brief article. Both are core-engine bugs, independent of any application. CISA says they affect all PHP installations serving web requests, including mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

Technical Mechanism

The PHP GHSA (GHSA-6wmf-4rv5-p3rp, “RCE via stale global state”) lists CWE-416, CWE-755, CWE-824, CWE-1325 and CWE-1419 (NVD lists four of the five, without CWE-1419). A PHP worker retains global state (error, session, object and extension state) that points into memory owned by a finished request. When that request heap is freed, the references stay. A later operation that runs before normal request initialization can read or free the stale state, producing a use-after-free.

Per the advisory, the pieces are:

• Producers: fatal errors (parse or compile failures, uncaught errors, failed require, max execution time), out-of-memory conditions, and non-fatal diagnostics raised during late shutdown.
• Confirmed consumers: INI diagnostics raised before request initialization (for example settings applied from .htaccess or Apache directory config under mod_php), and session upload progress handling.
• Confirmed cases: PHP 8.5 fatal error backtraces (fatal_error_backtraces), the strongest case, with confirmed RCE against mod_php; and the session upload progress lifecycle, validated against mod_php, with a validated PHP-FPM path that carries caveats, and OOM during input processing as the trigger. The advisory says an equivalent early consumer in FrankenPHP is not established in the default configuration.

Exploitation requires the producer and consumer requests to reach the same worker. The advisory’s impact statement: unauthenticated heap use-after-free, memory disclosure and RCE with the web worker’s privileges. Wiz’s write-up also lists an OPcache type confusion under this CVE; that appears only in Wiz, not in the GHSA or the NVD description, so treat it as Wiz’s account alone. Wiz maps the upload-progress issue to the sibling CVE-2026-109618, while GHSA-6wmf-4rv5-p3rp places it under this one. We follow the GHSA mapping.

Real-World Exploitation Evidence

CISA added CVE-2026-109619 to KEV on October 26, 2026, due October 29, forensic triage “Yes,” ransomware use “Unknown.”

We found no evidence of named threat actors, campaigns or victims as of October 27, 2026 in the CISA KEV entry, the CISA alert, the PHP advisory or Wiz’s write-up. The NVD record’s CISA SSVC entry from October 21 shows exploitation “none”, which predates the KEV listing. Wiz says it built a combined exploit script, php2shell, and reports RCE against WordPress, Drupal and Joomla images. We could not confirm whether it is public.

Impact Assessment

An unauthenticated remote attacker who can make two requests land on the same worker can gain code execution as the web user. Because the first request only needs to trigger a fatal error or OOM, the producer step is cheap. Targets with mod_php and PHP 8.5, or session upload progress enabled, are the confirmed cases.

Affected Versions

NVD’s lower bound (5.4.0) is far broader than the advisory’s. Wiz says every PHP version of the last decade, back to 5.4, is affected by at least one of the two CVEs. CISA’s alert calls PHP 8.1 and earlier unsupported and says to take PHP-based systems offline until patched or updated if you cannot update. We found no 8.1 fix in the php.net changelog as of October 27, 2026.

CVSS: NVD (primary) scores CVSS 3.1 at 8.1 (AV:N/AC:H/PR:N/UI:N, high C/I/A). PHP’s CNA scores CVSS 4.0 at 9.2. The sibling CVE-2026-109618 is 9.8 under NVD.

Remediation Steps

1. Inventory all PHP, including embedded copies.
2. Upgrade to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. The advisory calls this the only reliable mitigation.
3. If you cannot patch yet. The advisory says updating is the only reliable mitigation and there is no complete generic configuration mitigation; these are partial only:
   • PHP 8.5 only: set fatal_error_backtraces=0 and restart all workers.
   • Set session.upload_progress.enabled=0, and keep it off after patching if unused.
   • Remove attacker-reachable fatal errors and pre-initialization INI diagnostics; avoid predictable max-execution-time interruptions.
   • Consider pm.max_requests=1, which the advisory conditions on performance not being a factor.
4. Follow the remediation steps in GHSA-w8hw-w9fx-j79w too.

Detection Guidance

Use the signals in the sibling article: multipart requests followed by memory-limit errors, repeated 500s, oversized or malformed PHPSESSID cookies, worker churn. CISA recommends watching for PHP workers spawning shells or downloading tools and published a SIGMA rule. Fatal-error spikes in PHP logs on 8.5 deserve attention. No IOCs were published in the sources we read.

Timeline

References

• GHSA-6wmf-4rv5-p3rp: RCE via stale global state
• NVD: CVE-2026-109619
• CISA alert: Critical Vulnerabilities in PHP Require Immediate Patching
• Wiz Research: PHP2Shell