https://seclists.org/oss-sec/2026/q4/316: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
Published Oct 22, 2026
·Updated
Affected Software
1 affected component
PHP PHP>=8.2<=8.5
Frequently Asked Questions
1
Has the reported issue been confirmed as a separate vulnerability?
The report says Canonical asked php.org and was told it was unrelated and not a real issue. This is relayed through the discussion rather than a direct PHP security-team confirmation in the provided material.
2
Are further fixes planned based on this report?
The PHP team was reported to be aware of the report and to have no new plans as of the discussion.