Advisory · CVE-2026-109619
PHP stale global state across requests can be consumed before initialization and give remote code execution
PHP before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 can leave global state pointing into freed request memory when a reset is missed or state is repopulated after reset, so a later request on the same worker can act on stale state before initialization and give remote code execution. CVSS 3.1 9.8.
- Vendor
- PHP Group
- Product
- PHP
- Identifier / CWE
- CVE-2026-109619
CWE-416 - Action timing
- Immediate
Explain it like I’m five
A PHP worker keeps some global pointers into the memory of the request it just finished. If that memory is freed while a pointer still aims at it, the next request on the same worker can trip over the stale pointer before it gets cleaned up.
- 01First request publishes state
A PHP operation in one request stores request-owned error, session, object or extension state in a globally accessible location.
- 02Reset is missed
A fatal error, an out-of-memory interruption, or a diagnostic during cleanup prevents the matching reset, or repopulates the state after it was cleared.
- 03Request memory is freed
The worker releases the request heap while the global state still refers to it.
- 04Next request consumes stale state
A later request handled by the same worker reaches an operation, such as an INI diagnostic or session upload progress, that reads or branches on the stale state before normal initialization.
- 05Code runs as the web worker
Per the project advisory, a strategically crafted heap layout can produce full remote code execution, with cases confirmed against mod_php and FPM.
What happened
The PHP project disclosed CVE-2026-109619: PHP has various global state that temporarily points into request memory, and in some scenarios that state may not be correctly reset, or may be repopulated after being reset, so it can refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized, and the project advisory states that multiple strategies can trigger this condition and produce remote code execution. The advisory describes confirmed cases including the PHP 8.5 fatal error backtrace path against mod_php and the session upload progress lifecycle against mod_php and FPM. The CVSS 3.1 score is 9.8, with network attack vector, low complexity, no privileges, and no user interaction.
Per the affected data in the NVD record, the 8.2 line before 8.2.35, the 8.3 line before 8.3.36, the 8.4 line before 8.4.27 and the 8.5 line before 8.5.12 are affected, so upgrading to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later for your line is the stated fix. The project advisory says updating to a release containing the complete state reset patch is the only reliable mitigation and that there is no complete generic configuration mitigation; it also cross-references the related out-of-memory issue tracked as CVE-2026-109618, so apply the same release for both.
What to do
- Inventory PHP runtimes behind web servers and application servers, including mod_php, FPM, FrankenPHP and LSAPI deployments, and note the version and branch of each.
- Upgrade affected installations to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later for the branch in use, using the project release guidance.
- For PHP 8.5 installations that cannot update immediately, the project advisory notes setting fatal_error_backtraces to 0 administratively and restarting every worker removes the producer for the confirmed backtrace case; it does not cover the other state families.
- Where session upload progress is not needed, consider disabling it administratively per the project advisory, and restart every worker after any configuration change.
- Hunt for repeated fatal errors, maximum execution time errors, memory limit errors, and warnings raised before application code runs, especially on upload and multipart routes.
- Verify the deployed version on every worker after updating, including workers behind load balancers and in container images.
Management note
This is the companion half of the PHP release: a worker-level use after free that survives across requests on the same process. Patch it together with CVE-2026-109618 in the same PHP upgrade, and do not accept configuration tweaks as a substitute for the patched release.