CVE-2026-109619: PHP Remote Code Execution via Stale Global State
CVE-2026-109619 is one of the two critical PHP runtime vulnerabilities known as PHP2Shell. It is a stale global state flaw: state owned by one request can outlive the memory it points to, and a later request on the same worker may use it before normal initialization. This page covers the affected deployments, the fixed releases, and the temporary settings that target this CVE.
Last updated:
Based on the official php.net advisory. This page contains no exploitation instructions.
Free checker
Check a site for CVE-2026-109619 exposure
Enter a public URL. The checker compares the PHP version the site exposes with the first fixed release in its branch. A hidden version or a distribution suffix is reported as cannot determine, not as safe.
Free · No sign-up · We never store the URLs you check
The flaw
What is CVE-2026-109619?
The PHP project published CVE-2026-109619 on 21 October 2026. The advisory describes a stale global state problem. PHP can keep request-owned global state, including error, session, object, and extension state, after a request ends. If that state is not reset correctly, a later request handled by the same worker can access memory that has already been freed. That use-after-free can lead to memory disclosure and, in the worst case, remote code execution.
Fatal errors, memory exhaustion, and late diagnostics can leave stale state behind. Certain early operations may consume it before normal request initialization resets it. The flaw is in the PHP runtime, so it does not depend on a bug in the application, CMS, or framework. The official advisory is the authoritative source for the technical description.
A worker can outlive the request that poisoned it
PHP-FPM and other process managers reuse workers across requests. That reuse is efficient, but it also means state left behind by one request can be visible to the next. Restarting workers is part of remediation, not just a deployment formality.
Severity and scope
How serious is CVE-2026-109619?
The advisory rates the flaw CVSS v4.0 9.2, Critical, with no authentication required. All PHP installations that serve web requests are in scope: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The official advisory considers mod_php the highest-risk setup because a demonstrated exploit can run before application code.
Other SAPIs still need the update. A WAF, reverse proxy, or security plugin may block some request shapes, but it does not repair the PHP runtime. The same applies to updating WordPress, a framework, or a control panel. The fixed PHP binary is the boundary.
CVSS v4.0
9.2 · Critical
Use-after-free that can lead to memory disclosure or remote code execution.
Affected SAPIs
PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. mod_php is the highest-risk setup in the official advisory.
Fixed releases
Which PHP versions fix CVE-2026-109619?
The official fixes are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Every earlier release in those branches is affected. PHP 8.1, 8.0, 7.4, and older do not receive supported releases. The PHP project published minimal source backports for 7.4, 8.0, and 8.1, and some distributions provide patched packages, but those are not supported PHP releases. Upgrading to PHP 8.4 or 8.5 is the supported path.
PHP 8.2 still receives security fixes, but its security support ends on 31 December 2026. Treat it as a short-term landing point. The full per-branch table, including support status, is on the PHP2Shell checker.
A distro build may already be patched. Version strings such as -1ubuntu2.19 carry a package revision. The distribution can backport the fix without changing the upstream version, so a passive checker reports cannot determine. Confirm with the vendor advisory.
Temporary mitigations
Settings that target CVE-2026-109619
Updating is the only reliable fix. The advisory says there is no complete generic configuration workaround. The settings below reduce exposure to confirmed paths, but they do not cover every variant and do not address CVE-2026-109618.
- Set
session.upload_progress.enabled=0in php.ini, the PHP-FPM pool, or server configuration, then restart every PHP worker. Apply it before request parsing. Do not rely onini_set()or.user.ini, which run too late. - On PHP 8.5, set
fatal_error_backtraces=0and restart every worker. This closes the confirmed fatal-backtrace path only. - Remove invalid or deprecated per-request settings that emit diagnostics before initialization. Hiding the output with
error_reporting,display_errors, or@does not remove the stale state. - Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing, and cleanup.
These measures are partial. Consider leaving session upload progress disabled after patching if the application does not use it. The PHP2Shell advisory combines both CVEs in one example configuration.
Both CVEs
How CVE-2026-109619 relates to CVE-2026-109618
CVE-2026-109618 is the out-of-memory corruption flaw. CVE-2026-109619 is the stale global state flaw. They were published together and share fixed releases, but they describe different failure paths. Mitigating the OOM path does not close the stale-state path, and the reverse is also true. Read the CVE-2026-109618 guide for the memory and request-limit measures.
Both are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. One update resolves both; restart every worker afterward so the new binary is loaded. Replacing files without a restart can leave the vulnerable binary running.
Verification
How to confirm the web server is patched
A passive check can confirm a version only when the site exposes one. The checker reads public headers and homepage markup; a hidden version or a distribution suffix is reported as cannot determine. That is a limit of remote inspection, not a clean bill of health.
To verify the web SAPI directly, use WordPress Site Health (Tools → Site Health → Info → Server), cPanel's Select PHP Version or MultiPHP Manager, Plesk's PHP Settings, or a temporary PHP file. Delete any temporary file immediately. The patch guide covers updating and restarting; the cPanel and Plesk guide covers panel-managed hosting.
Check the web version, not only php -v. The CLI and the web server can use different PHP builds, and a worker can keep running the old binary until it is restarted.
Keep reading
Related guides
CVE-2026-109618
The out-of-memory corruption flaw, its request-size limits, and the memory settings that target it.
Read guidePHP2Shell checker
The combined advisory, the fixed-version table, and one example configuration for both CVEs.
Read guidePatch PHP2Shell
Install a fixed PHP release, restart every worker, and verify the version through the web server.
Read guidePHP2Shell and WordPress
Check PHP in Site Health or WP-CLI, and understand why a WordPress update is not enough.
Read guideFAQ
CVE-2026-109619 questions
Short answers about the stale global state flaw, the fixed releases, and what the temporary settings can and cannot do.
Is CVE-2026-109619 part of PHP2Shell?
Which PHP versions fix CVE-2026-109619?
Is there a workaround for CVE-2026-109619?
Official references
- PHP security advisory (php.net)
- GHSA-6wmf-4rv5-p3rp (official GitHub advisory)
- GHSA-w8hw-w9fx-j79w (the related CVE)
- PHP2Shell checker and affected-version table
- CVE-2026-109618 guide
- How to patch PHP2Shell
This guide summarizes the official PHP advisory for site owners. It is not a security audit. A patched PHP version does not by itself prove that a site is secure.
Check another site
The checker is free and does not require an account.