https://seclists.org/oss-sec/2026/q4/321: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Q: Which PHP releases should be updated?

Update PHP 8.2 to 8.2.35 or later, PHP 8.3 to 8.3.36 or later, PHP 8.4 to 8.4.27 or later, and PHP 8.5 to 8.5.12 or later. The affected ranges given are versions before those releases.

Q: Can installations running PHP versions older than 8.2 be considered unaffected?

The supplied discussion warns that the stated ranges could be interpreted as excluding older versions, but does not confirm that conclusion. It cites separate material saying nearly every PHP version back to 5.4 is affected by at least one of several issues, not specifically this one.

Q: Does the supplied information confirm that this specific issue is exploitable without authentication?

No. The quoted material says that the vulnerabilities collectively can permit unauthenticated code execution or process-memory disclosure, but it does not attribute that condition specifically to this issue.

Published Oct 22, 2026

Updated

Affected Software

1 affected component

PHP PHP>=8.2<8.2.35, >=8.3<8.3.36, >=8.4<8.4.27, >=8.5<8.5.12

Frequently Asked Questions

Which PHP releases should be updated?

Update PHP 8.2 to 8.2.35 or later, PHP 8.3 to 8.3.36 or later, PHP 8.4 to 8.4.27 or later, and PHP 8.5 to 8.5.12 or later. The affected ranges given are versions before those releases.

Can installations running PHP versions older than 8.2 be considered unaffected?

The supplied discussion warns that the stated ranges could be interpreted as excluding older versions, but does not confirm that conclusion. It cites separate material saying nearly every PHP version back to 5.4 is affected by at least one of several issues, not specifically this one.

Does the supplied information confirm that this specific issue is exploitable without authentication?

No. The quoted material says that the vulnerabilities collectively can permit unauthenticated code execution or process-memory disclosure, but it does not attribute that condition specifically to this issue.