CVE-2026-109619
9.2 critical
KEV · due 2026-10-29
exploit ×27
SSVC exploitation: active
Analyzed
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Fix
Public exploits 27
- 1Nightlovel/CVE-2026-109619 PoC on GitHub
- DarynOngera/solid-palm-tree PoC on GitHub
- EQSTLab/CVE-2026-109619 PoC on GitHub
- FarhadHosen101/PHP2Shell-CVE-2026-109619 PoC on GitHub
- LordX404/php2shell-exploit PoC on GitHub
- MorphingYU/CVE-2026-109619 PoC on GitHub
- Prajjwal-Srivastava/php2shell_scanner PoC on GitHub
- RuanSerraAzul/CVE-2026-109619-POC PoC on GitHub
- Taz1920/cve-2026-109619 PoC on GitHub
- VKKKV/php2shell-exp PoC on GitHub
- WallcroftUK/CVE-2026-109619 PoC on GitHub
- aarsaputra/php2shell PoC on GitHub
- abraxas/php-stale-global-uaf PoC on GitHub
- baimaobg/php-cve-2026-109619-lab PoC on GitHub
- basesixtythree/B63-POC-CVE-2026-109619 PoC on GitHub
- cozybear-dev/cve-2026-109619 PoC on GitHub
- dev-maple/php2shell-CVE-2026-109619 PoC on GitHub
- fellipgomes/br-php2shell PoC on GitHub
- fmdiscioglu/php-cve-2026-109619-checker PoC on GitHub
- franckferman/CVE-2026-109619 PoC on GitHub
- and 7 more
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
CISA KEV required action · due 2026-10-29
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Added to the catalog 2026-10-26. CISA KEV
Patch, vendor advisory and mitigation references on NVD 1
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp Mitigation, Vendor Advisory
Vendor advisories in the News 5
- CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL) Palo Alto Networks Security Advisories · 2026-10-27
- Vulnerabilities in PHP Affecting Cisco Products: October 2026 Cisco Security Advisories · 2026-10-23
- PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) AWS Security Bulletins · 2026-10-21
- USN-8948-1: PHP vulnerabilities Ubuntu Security Notices · 2026-10-21
- PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619) Fortinet PSIRT Advisories · 2026-10-21
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
In the news 10
- CISA confirms PHP2Shell vulnerabilities now exploited in attacks r/cybersecurity · 2026-10-27
- CISA confirms PHP2Shell under attack as researchers clock successful exploits The Register · Security · 2026-10-27
- U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog Security Affairs · 2026-10-27
- PHP2Shell Sentinel — PHP CVE-2026-109618 & CVE-2026-109619 Mitigation Tool & WAF r/cybersecurity · 2026-10-26
- PHP2Shell: What to know about two critical PHP flaws WeLiveSecurity (ESET) · 2026-10-26
- CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA advisories and alerts · 2026-10-26
- PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts Security Affairs · 2026-10-26
- PHP2Shell security flaws now sucessfully exploited in the wild BleepingComputer · 2026-10-26
- Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25) - "We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23." r/blueteamsec · 2026-10-26
- PHP2Shell: No login, no app code, no warning. What next? The Register · Security · 2026-10-26
Change history 18
- References+3 references (now 17)NVD modified 2026-10-27 13:43
- CISA KEVadded to CISA KEV, due 2026-10-29
- References+2 references (now 14)NVD modified 2026-10-23 16:06
- Cpes+289 CPE criteria (now 290)NVD modified 2026-10-23 16:06
- StatusModified → AnalyzedNVD modified 2026-10-23 13:22
- References+5 references (now 12)NVD modified 2026-10-22 21:17
- References+1 references (now 7)NVD modified 2026-10-22 09:17
- References+1 references (now 6)NVD modified 2026-10-21 21:17
- References+2 references (now 5)NVD modified 2026-10-21 19:16
- References+1 references (now 3)NVD modified 2026-10-21 17:18
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-21 17:18
- StatusPublished → ModifiedNVD modified 2026-10-21 17:18
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-21 14:36
- CwesCWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 → CWE-416, CWE-755, CWE-824, CWE-1325NVD modified 2026-10-21 16:12
- References+1 references (now 2)NVD modified 2026-10-21 16:12
- StatusPublished → Undergoing AnalysisNVD modified 2026-10-21 16:12
- CVSS9.2 (v4.0, CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) → 9.2 (v4.0, CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)NVD modified 2026-10-21 16:12
- First seenCVSS 9.2 · php groupNVD modified 2026-10-21 13:54
Affected (CPE criteria) 290
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h10:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h11:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h13:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h14:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h15:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h17:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h20:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h22:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h23:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h24:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h32:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h34:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h35:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h36:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h37:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h38:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h5:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h7:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h9:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:*:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:*:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:*:*:*:*:*:*- and 250 more
References 17
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp Mitigation, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/16 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/17 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/23 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/7 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/14 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/15 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/16 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/19 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/22/20 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/10/23/4 Mailing List, Third Party Advisory
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/ Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-566512.html Third Party Advisory
- https://php2shell.delftintellab.com/ Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619 US Government Resource
- https://www.wiz.io/blog/php2shell-php-rce Third Party Advisory