BIT-php-2026-109619: RCE via stale global state

Q: Does exploitation require authentication or user interaction?

No privileges or user interaction are required according to the supplied severity vector. Exploitation is network-reachable, but it has high attack complexity and requires additional conditions to be present.

Q: Which deployments are most relevant to triage first?

Prioritize deployments using bitnami/libphp, bitnami/php, or bitnami/php-min that process subsequent requests. The condition involves stale state from an earlier request being read or acted on during a later request.

Published Oct 22, 2026

Updated

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Affected Software

12 affected componentsFixes available

bitnami/libphp>=5.4.0<8.2.35

8.2.35

bitnami/libphp>=8.3.0<8.3.36

8.3.36

bitnami/libphp>=8.4.0<8.4.27

8.4.27

bitnami/libphp>=8.5.0<8.5.12

8.5.12

bitnami/php>=5.4.0<8.2.35

8.2.35

bitnami/php>=8.3.0<8.3.36

8.3.36

bitnami/php>=8.4.0<8.4.27

8.4.27

bitnami/php>=8.5.0<8.5.12

8.5.12

bitnami/php-min>=5.4.0<8.2.35

8.2.35

bitnami/php-min>=8.3.0<8.3.36

8.3.36

bitnami/php-min>=8.4.0<8.4.27

8.4.27

bitnami/php-min>=8.5.0<8.5.12

8.5.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/libphp to a version that resolves this vulnerability.
Fixed in 8.2.35
Upgrade
Upgrade bitnami/libphp to a version that resolves this vulnerability.
Fixed in 8.3.36
Upgrade
Upgrade bitnami/libphp to a version that resolves this vulnerability.
Fixed in 8.4.27
Upgrade
Upgrade bitnami/libphp to a version that resolves this vulnerability.
Fixed in 8.5.12
Upgrade
Upgrade bitnami/php to a version that resolves this vulnerability.
Fixed in 8.2.35
Upgrade
Upgrade bitnami/php to a version that resolves this vulnerability.
Fixed in 8.3.36
Upgrade
Upgrade bitnami/php to a version that resolves this vulnerability.
Fixed in 8.4.27
Upgrade
Upgrade bitnami/php to a version that resolves this vulnerability.
Fixed in 8.5.12
Upgrade
Upgrade bitnami/php-min to a version that resolves this vulnerability.
Fixed in 8.2.35
Upgrade
Upgrade bitnami/php-min to a version that resolves this vulnerability.
Fixed in 8.3.36
Upgrade
Upgrade bitnami/php-min to a version that resolves this vulnerability.
Fixed in 8.4.27
Upgrade
Upgrade bitnami/php-min to a version that resolves this vulnerability.
Fixed in 8.5.12

Event History

Oct 22, 2026

Advisory Published

via OSV·08:04 AM

Data Sourced

via OSV·08:04 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Does exploitation require authentication or user interaction?

No privileges or user interaction are required according to the supplied severity vector. Exploitation is network-reachable, but it has high attack complexity and requires additional conditions to be present.

Which deployments are most relevant to triage first?

Prioritize deployments using bitnami/libphp, bitnami/php, or bitnami/php-min that process subsequent requests. The condition involves stale state from an earlier request being read or acted on during a later request.

BIT-php-2026-109619: RCE via stale global state

Affected Software

Remediation

Event History

Frequently Asked Questions

Does exploitation require authentication or user interaction?

Which deployments are most relevant to triage first?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require authentication or user interaction?

Which deployments are most relevant to triage first?