PHP released 8.2.35, 8.3.36, 8.4.27 and 8.5.12 to fix CVE-2026-109619, which the PHP project rates Critical (CVSS v4 9.2) and says allows unauthenticated remote code execution when freed request state is reused by a later request. watchTowr reports exploitation in the wild via its honeypots and Cloudflare reports attack traffic; CISA has not listed it in KEV.
Affected: PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12 serving web requests. PHP 8.1 and older get no upstream fix.
Fix: Upgrade to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restart all workers.
Updated Oct 21, 2026. Changed: Added watchTowr and Cloudflare exploitation reports; not in CISA KEV.
AI-written summary, Oct 21, 2026Confirm details in the vendor advisory before acting.Source: GitHub
Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
