CVE-2026-109619

Nghiêm trọng 9.2 CWE-416 Công bố 21:17 21/10/2026

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Tham khảo

Xem trên NVD ↗

PoC (9)

⚠ Chưa kiểm duyệt. Chỉ chạy trong máy ảo.

unlimit0118/CVE-2026-109619-php2shell-poc
★ 421 giờ trước

Minimal PHP session upload progress use-after-free PoC and Docker lab.
cozybear-dev/cve-2026-109619
★ 218 giờ trước
baimaobg/php-cve-2026-109619-lab
★ 16 giờ trước
xvanpan/CVE-2026-109619
★ 01 ngày trước
santihabib/CVE-2026-109619
★ 023 giờ trước

Cross-request use-after-free in PHP session.upload_progress (CVE-2026-109619) — root-cause analysis and reproducer for PHP 8.5.11
fmdiscioglu/php-cve-2026-109619-checker
★ 023 giờ trước

Non-destructive affected-version checker for CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) PHP UAF
1Nightlovel/CVE-2026-109619
★ 018 giờ trước

php2shellscanner
syrex1013/CVE-2026-109619
★ 018 giờ trước
basesixtythree/B63-POC-CVE-2026-109619
★ 015 giờ trước

PoC and verification material for CVE-2026-109619 (PHP stale worker-global state)