CVE-2026-109619

www.zend.com • October 23, 2026

PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, session and error handling operations run before normal initialization of the request. They inadvertently access stale state not reset by the request before initialization has a chance to replace it, causing a use after free. A strategically crafted heap layout can produce full remote code execution (RCE).

This vulnerability affects all PHP 5, PHP 7, and PHP 8.0 and 8.1 versions, as well as the listed PHP 8 versions in this disclosure.

Updating to a PHP release containing the patch to this vulnerability is the only complete mitigation.

Several other mitigations can be made to help prevent issues until you can patch; however do not consider these as complete solutions, and update to a patched version as soon as possible:

Disable the PHP 8.5 fatal_error_backtraces setting.

Disable session.upload_progress.enabled

If possible, use a reverse proxy or Web Application Firewall (WAF) to rate limit or disable multi-part uploads where they are not needed/accepted on your site.

Use AppArmor or SELinux to restrict PHP's access to system binaries if possible.

Direct link to CVE-2026-109619 >

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities Exploited Before Public Disclosure Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both vulnerabilities allow unauthenticated remote code execution (RCE) and have a CVSS score of 9.2. The attack vector involves the `session.upload_progress` feature in PHP, which can be manipulated to execute arbitrary code. Patches were released on October 21, 2026, but exploitation attempts continued shortly after the fixes were made public. The vulnerabilities affect multiple PHP versions, including those that are no longer supported. Organizations are urged to apply the patches immediately and review their systems for potential exposure. 187 sources 73

Extracted Entities

CVE-2026-109619

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)