PHP Stale Internal Request-State Vulnerability

🚨SEVERITY: HIGH — CVSS 8.1Security Advisory

TL;DR 📌

  • PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
  • Highest CVSS: 8.1 (High).
  • Listed in CISA KEV (2026-10-26) — this is being exploited in the wild.
  • Fixed in 10.2.7, 11.1.4, 11.2.4, 12.1.4 — upgrade to this release or later.
  • CVEs: CVE-2026-109619.

What it is

This is a memory-safety flaw in PHP’s internal request handling. PHP maintains global state that temporarily points into memory allocated for the current request. In certain scenarios that state is not correctly reset between requests, or gets repopulated after a reset, so it ends up referencing request memory that has already been freed.

A subsequent request can then read from, or branch on, that stale global state before it has been properly reinitialised. The advisory notes multiple strategies can trigger this condition, and the result is remote code execution — not just an information leak or crash.

The vector is network-based with no authentication and no user interaction required (AV:N, PR:N, UI:N), though attack complexity is rated high (AC:H), meaning exploitation depends on specific conditions in how requests are processed rather than being trivially repeatable on demand. Given the mechanism, any PHP deployment that processes untrusted requests — which is effectively any public-facing PHP application — presents the relevant attack surface at the PHP runtime level, not in a specific extension or SAPI.

CVE-2026-109619 is listed in CISA’s Known Exploited Vulnerabilities catalogue, added 26 October 2026.

What to do

  • Patch PHP to the fixed version for your branch: 8.2.35, 8.3.36, 8.4.27, 8.5.12, 10.2.7, 11.1.4, 11.2.4, 12.1.4, or 12.2.4, depending on which major/minor line you run.
  • Because this sits in core request-state handling rather than a single module, check all PHP runtimes in your estate — web servers, CLI workers, queue consumers — not just the ones directly facing the internet.
  • Given the CISA KEV listing, treat this as a priority patch rather than part of routine maintenance; schedule it ahead of your normal cycle.
  • After patching, confirm the running version with php -v or your package manager’s version query on each host, since PHP is frequently bundled or vendored into containers and may not be updated by a system-wide package update alone.
  • If you cannot patch immediately, consult the PHP Group’s advisory for any documented mitigations or configuration workarounds specific to your version before relying on WAF rules, which are unlikely to reliably catch a memory-state race condition.

For leadership 🧭

Executive summary. This flaw sits in PHP’s core runtime rather than a single extension, so it affects essentially any public-facing PHP application, and it is already listed in CISA’s Known Exploited Vulnerabilities catalogue. Given unauthenticated, no-interaction remote code execution is possible, this needs patching ahead of the normal maintenance cycle, not folded into it.

Why it matters:

  • The bug is in PHP’s core request-state handling, not a specific module or SAPI, so every PHP runtime that processes untrusted input — web-facing servers, CLI workers, queue consumers — shares the same exposure.
  • The vector requires no authentication and no user interaction (PR:N, UI:N), and the outcome is remote code execution rather than a crash or data leak, giving a successful attacker full control of the affected process.
  • Active exploitation is already known, as reflected by its addition to CISA’s KEV catalogue on 26 October 2026.
  • PHP is frequently vendored into containers and images, so a host-level package update may leave an outdated PHP binary running inside application containers undetected.

Now / Next / Later:

  • Now: Identify every PHP major/minor line in your estate and confirm whether each is below its fixed version (8.2.35, 8.3.36, 8.4.27, 8.5.12, 10.2.7, 11.1.4, 11.2.4, 12.1.4, 12.2.4).
  • Next: Patch all PHP runtimes — including CLI workers and queue consumers, not just internet-facing web servers — to the fixed version for their branch, prioritising this ahead of routine maintenance given the KEV listing.
  • Later: Build version verification (php -v or package manager query) into container image builds and deployment pipelines so bundled or vendored PHP binaries are caught by future patch cycles, not just system-wide updates.

Source