https://seclists.org/oss-sec/2026/q4/317: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Q: Which PHP deployment models have demonstrated unauthenticated exploitation?

Unauthenticated remote code execution has been demonstrated against Apache mod_php and PHP-FPM. Exploitability still depends on the affected state, configuration, and application behavior.

Q: Does a configuration change provide a reliable temporary mitigation?

No. Updating is the only reliable mitigation, and there is no complete generic configuration workaround.

Q: Which release levels address the issue?

Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or to a later release in the corresponding branch.

Published Oct 22, 2026

Updated

Affected Software

1 affected component

PHP PHP>=8.2<8.2.35, >=8.3<8.3.36, >=8.4<8.4.27, >=8.5<8.5.12

Frequently Asked Questions

Which PHP deployment models have demonstrated unauthenticated exploitation?

Unauthenticated remote code execution has been demonstrated against Apache mod_php and PHP-FPM. Exploitability still depends on the affected state, configuration, and application behavior.

Does a configuration change provide a reliable temporary mitigation?

No. Updating is the only reliable mitigation, and there is no complete generic configuration workaround.

Which release levels address the issue?

Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or to a later release in the corresponding branch.