Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
CVE-2026-109619 Details
Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
A use-after-free vulnerability has been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. This vulnerability arises from various global states that temporarily reference request memory. In certain scenarios, this global state may not be properly reset or can be repopulated after being cleared, leading to references of freed memory. Subsequent requests may then access this stale state before it is fully reinitialized. This vulnerability can be exploited to achieve remote code execution (RCE).
Users should update to PHP versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12. For PHP 8.5 installations that cannot update, set 'fatal_error_backtraces=0' and restart every worker. This removes the producer used by the confirmed RCE case. For the session lifecycle case, set 'session.upload_progress.enabled=0' and restart every worker. If performance is not a factor, consider limiting the number of requests a worker may execute using 'pm.max_requests=1'.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 21, 2026Exploitation: ActiveAutomatable: NoTechnical Impact: Total
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| PHP Stale Internal Request-State Vulnerability | Oct 26, 2026 | Oct 29, 2026 | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1325 | Improperly Controlled Sequential Memory Allocation | [email protected] |
| CWE-416 | Use After Free | [email protected] |
| CWE-755 | Improper Handling of Exceptional Conditions | [email protected] |
| CWE-824 | Access of Uninitialized Pointer | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| php php | >= 5.4.0, < 8.2.35 >= 8.3.0, < 8.3.36 >= 8.4.0, < 8.4.27 >= 8.5.0, < 8.5.12 |
CPE
Remediation
| |
| siemens ruggedcom ape1808 firmware | All versions |
CPE
Remediation
| |
| siemens ruggedcom ape1808 | All versions |
CPE
Remediation
| |
| paloaltonetworks pan-os | >= 10.2.0, < 10.2.7 10.2.7 - 10.2.7 h1 10.2.7 h10 10.2.7 h11 10.2.7 h12 10.2.7 h13 10.2.7 h14 10.2.7 h15 10.2.7 h16 10.2.7 h17 10.2.7 h18 10.2.7 h19 10.2.7 h2 10.2.7 h20 10.2.7 h21 10.2.7 h22 10.2.7 h23 10.2.7 h24 10.2.7 h3 10.2.7 h32 10.2.7 h34 10.2.7 h35 10.2.7 h36 10.2.7 h37 10.2.7 h38 10.2.7 h4 10.2.7 h5 10.2.7 h6 10.2.7 h7 10.2.7 h8 10.2.7 h9 10.2.8 10.2.9 10.2.10 - 10.2.10 h1 10.2.10 h10 10.2.10 h11 10.2.10 h12 10.2.10 h13 10.2.10 h14 10.2.10 h17 10.2.10 h18 10.2.10 h2 10.2.10 h21 10.2.10 h27 10.2.10 h3 10.2.10 h30 10.2.10 h31 10.2.10 h36 10.2.10 h37 10.2.10 h39 10.2.10 h4 10.2.10 h40 10.2.10 h41 10.2.10 h5 10.2.10 h6 10.2.10 h7 10.2.10 h8 10.2.10 h9 10.2.11 10.2.12 10.2.13 - 10.2.13 h1 10.2.13 h10 10.2.13 h15 10.2.13 h16 10.2.13 h18 10.2.13 h2 10.2.13 h21 10.2.13 h22 10.2.13 h23 10.2.13 h24 10.2.13 h26 10.2.13 h3 10.2.13 h4 10.2.13 h5 10.2.13 h7 10.2.14 10.2.15 - 10.2.16 - 10.2.16 h1 10.2.16 h10 10.2.16 h11 10.2.16 h4 10.2.16 h6 10.2.16 h7 10.2.16 h8 10.2.16 h9 10.2.17 - 10.2.18 - 10.2.18 h1 10.2.18 h10 10.2.18 h12 10.2.18 h5 10.2.18 h6 10.2.18 h7 10.2.18 h8 10.2.18 h9 >= 11.1.0, < 11.1.4 11.1.4 - 11.1.4 h1 11.1.4 h10 11.1.4 h11 11.1.4 h12 11.1.4 h13 11.1.4 h15 11.1.4 h16 11.1.4 h17 11.1.4 h18 11.1.4 h2 11.1.4 h25 11.1.4 h27 11.1.4 h3 11.1.4 h32 11.1.4 h33 11.1.4 h34 11.1.4 h35 11.1.4 h36 11.1.4 h37 11.1.4 h4 11.1.4 h5 11.1.4 h6 11.1.4 h7 11.1.4 h8 11.1.4 h9 11.1.5 11.1.6 - 11.1.6 h1 11.1.6 h10 11.1.6 h14 11.1.6 h17 11.1.6 h18 11.1.6 h19 11.1.6 h2 11.1.6 h20 11.1.6 h21 11.1.6 h22 11.1.6 h23 11.1.6 h25 11.1.6 h29 11.1.6 h3 11.1.6 h32 11.1.6 h33 11.1.6 h34 11.1.6 h35 11.1.6 h36 11.1.6 h38 11.1.6 h39 11.1.6 h4 11.1.6 h5 11.1.6 h6 11.1.6 h7 11.1.7 - 11.1.7 h1 11.1.7 h10 11.1.7 h11 11.1.7 h2 11.1.7 h4 11.1.7 h6 11.1.7 h8 11.1.8 - 11.1.9 - 11.1.10 - 11.1.10 h1 11.1.10 h10 11.1.10 h12 11.1.10 h21 11.1.10 h25 11.1.10 h26 11.1.10 h27 11.1.10 h28 11.1.10 h30 11.1.10 h32 11.1.10 h33 11.1.10 h35 11.1.10 h4 11.1.10 h5 11.1.10 h7 11.1.10 h9 11.1.11 - 11.1.12 - 11.1.13 - 11.1.13 h1 11.1.13 h10 11.1.13 h11 11.1.13 h12 11.1.13 h15 11.1.13 h2 11.1.13 h3 11.1.13 h5 11.1.13 h6 11.1.13 h7 11.1.13 h8 11.1.13 h9 11.1.14 - 11.1.15 - 11.1.16 - 11.1.16 h1 11.1.16 h2 11.1.16 h3 >= 11.2.0, < 11.2.4 11.2.4 - 11.2.4 h1 11.2.4 h10 11.2.4 h11 11.2.4 h12 11.2.4 h14 11.2.4 h15 11.2.4 h17 11.2.4 h18 11.2.4 h2 11.2.4 h20 11.2.4 h3 11.2.4 h4 11.2.4 h5 11.2.4 h6 11.2.4 h7 11.2.4 h8 11.2.4 h9 11.2.5 11.2.6 - 11.2.7 - 11.2.7 h1 11.2.7 h10 11.2.7 h11 11.2.7 h12 11.2.7 h13 11.2.7 h14 11.2.7 h15 11.2.7 h16 11.2.7 h17 11.2.7 h18 11.2.7 h19 11.2.7 h2 11.2.7 h3 11.2.7 h4 11.2.7 h7 11.2.7 h8 11.2.8 - 11.2.9 11.2.10 - 11.2.10 h1 11.2.10 h10 11.2.10 h12 11.2.10 h13 11.2.10 h2 11.2.10 h3 11.2.10 h4 11.2.10 h5 11.2.10 h6 11.2.10 h7 11.2.10 h8 11.2.10 h9 11.2.11 - 11.2.12 - 11.2.13 - 11.2.13 h1 11.2.13 h2 11.2.13 h3 11.2.15 - 11.2.16 - >= 12.1.0, < 12.1.4 12.1.4 - 12.1.4 h10 12.1.4 h11 12.1.4 h12 12.1.4 h2 12.1.4 h3 12.1.4 h5 12.1.4 h6 12.1.4 h7 12.1.4 h8 12.1.4 h9 12.1.5 - 12.1.6 - 12.1.7 - 12.1.7 h1 12.1.7 h2 12.1.7 h3 12.1.7 h5 12.1.7 h6 12.1.7 h8 12.1.7 h9 12.1.8 - 12.1.9 - 12.1.10 - 12.1.10 h2 >= 12.2.0, < 12.2.4 12.2.4 - |
CPE
Remediation
| |
| paloaltonetworks panorama m-200 | All versions |
CPE
Remediation
| |
| paloaltonetworks panorama m-300 | All versions |
CPE
Remediation
| |
| paloaltonetworks panorama m-500 | All versions |
CPE
Remediation
| |
| paloaltonetworks panorama m-600 | All versions |
CPE
Remediation
| |
| paloaltonetworks panorama m-700 | All versions |
CPE
Remediation
| |
| paloaltonetworks panorama virtual appliance | All versions |
CPE
Remediation
| |
| paloaltonetworks wf-500 | All versions |
CPE
Remediation
| |
| paloaltonetworks wf-500-b | All versions |
CPE
Remediation
| |
| siemens amis ts | All versions |
CPE
Remediation
| |
| siemens blueplanet 360 nx3 m6 wm od iisx-s firmware | All versions |
CPE
Remediation
| |
| siemens blueplanet 360 nx3 m6 wm od iisx-s | All versions |
CPE
Remediation
| |
| siemens energy engage | 2.0 service_pack9 3.1 service_pack1 |
CPE
Remediation
| |
| siemens spectrum power 3 | All versions |
CPE
Remediation
| |
| siemens spectrum power 4 | All versions |
CPE
Remediation
| |
| siemens spectrum power 7 | All versions |
CPE
Remediation
| |
| siemens spectrum power tg | All versions |
CPE
Remediation
| |
| siemens blueplanet 360 nx3 m6 wm od iisx firmware | All versions |
CPE
Remediation
| |
| siemens blueplanet 360 nx3 m6 wm od iisx | All versions |
CPE
Remediation
| |
Change History
24 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | siemens-SADP |
| Nov 4, 2026 | CVE Modified | siemens-SADP |
| Nov 2, 2026 | Modified Analysis | [email protected] |
| Oct 30, 2026 | CVE Modified | siemens-SADP |
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | Modified Analysis | [email protected] |
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | CVE CISA KEV Update | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
| Oct 26, 2026 | CVE Translated | [email protected] |
| Oct 23, 2026 | Modified Analysis | [email protected] |
| Oct 23, 2026 | CVE Modified | CVE |
| Oct 23, 2026 | CVE Modified | siemens-SADP |
| Oct 23, 2026 | Modified Analysis | [email protected] |
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | CVE Modified | CVE |
| Oct 22, 2026 | Modified Analysis | [email protected] |
| Oct 22, 2026 | CVE Translated | [email protected] |
| Oct 22, 2026 | CVE Modified | CVE |
| Oct 21, 2026 | CVE Modified | CVE |
| Oct 21, 2026 | CVE Modified | CVE |
| Oct 21, 2026 | CVE Modified | CVE |
| Oct 21, 2026 | Initial Analysis | [email protected] |
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |