CVE-2026-109619: PHP remote code execution via stale global state

What is CVE-2026-109619?

CVE-2026-109619 is the second PHP2Shell vulnerability; PHP’s official title is “RCE via stale global state”. PHP workers handle many requests one after another. When a request finishes, its memory is freed, but some global state could keep pointing at it. A later request that uses that stale reference touches freed memory, which an attacker can turn into code execution.

The GitHub advisory rates it Critical, CVSS 4.0 score 9.2, vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N: reachable over the network with no login and no user interaction, though attack complexity is rated high and certain conditions must be present.

Which PHP versions are affected by CVE-2026-109619?

Every supported branch below its fixed release is affected, and so are end-of-life branches. PHP 8.1 and older get no new releases; PHP published minimal source patches for 7.4, 8.0 and 8.1 only (see PHP end of life).

Distribution packages carry their own fixed versions. The table below also lists images, panels and hosts whose status we haven’t verified yet:

How do I fix CVE-2026-109619?

Update PHP to the fixed release for your branch, or your distribution’s patched package, then restart every PHP worker so no process keeps the old code. The GitHub advisory is clear: “Updating to a release containing the complete state reset patch is the only reliable mitigation.” The PHP2Shell patch guide covers each setup.

Can I mitigate CVE-2026-109619 without updating?

Only partly. PHP lists two administrative settings, each followed by a restart of every worker:

• session.upload_progress.enabled=0, set in php.ini, the FPM pool or server configuration (not ini_set() or FPM .user.ini). It blocks the confirmed session paths but not other variants.
• On PHP 8.5 only, fatal_error_backtraces=0. It blocks the confirmed fatal-backtrace path only.

PHP states there is no complete generic configuration mitigation. See the CVE-2026-109618 workaround page for all stopgaps and their side effects.

Why do PHP workers matter for CVE-2026-109619?

The flaw involves long-running PHP worker processes, which handle one request after another. That’s why both the update and the stopgaps require restarting every worker: PHP-FPM pools, Apache with mod_php, or the PHP process of your server. A worker that keeps running after an update still has the old code in memory. On shared hosting, your host handles the restart; ask them to confirm it.

Which setups are exposed to CVE-2026-109619?

PHP’s advisory covers all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and rates mod_php highest risk. Using Nginx or PHP-FPM is not an exemption. Command-line-only use isn’t covered by the warning, but update the binary anyway.

Does a maintenance-mode plugin stop CVE-2026-109619?

Don’t rely on it. A WordPress maintenance page still runs PHP’s request handling, and some attack paths happen before application code runs. Block traffic before PHP (at the web server or hosting level) or take the site offline if you can’t update.

Is CVE-2026-109619 exploited in the wild?

Attack attempts have been reported, but successful compromise has not been confirmed. Cloudflare reported PHP2Shell attack traffic against its customers before the fix was released. None of the sources we checked as of 22 Oct 2026 confirms a successful takeover. Treat unpatched web-facing PHP as exposed and update.

How do I check whether my site is affected by CVE-2026-109619?

Enter your website’s PHP version and setup in the PHP version checker, or see the PHP2Shell checker overview. The companion flaw is CVE-2026-109618.

Which sources support this page?

• GitHub advisory GHSA-6wmf-4rv5-p3rp
• The PHP Group: security advisory
• Wiz Research: original research
• Canonical: Ubuntu CVE page
• Cloudflare: WAF protections