CVE-2026-109619
PHP
What this is
PHP can keep using memory after it has been released. Later requests can use this stale information and allow an attacker to run their own program on the server.
How it can harm you
An attacker can run their own program on the server over a network without signing in or requiring anyone to interact. Exploitation is complex and requires particular conditions; the exact conditions are not specified.
How urgent it is
This vulnerability is already being used in attacks. Update PHP promptly because the flaw can let an attacker run their own program on the server.
Who is affected
Affected PHP releases are 8.2.* before 8.2.35, 8.3.* before 8.3.36, 8.4.* before 8.4.27, and 8.5.* before 8.5.12.
What to do
Update PHP to the fixed release for your branch: 8.2.35 for 8.2.*, 8.3.36 for 8.3.*, 8.4.27 for 8.4.*, or 8.5.12 for 8.5.*.
How to check your server
Check the installed PHP version in your server's software information, then compare it with the affected and fixed releases in the PHP Group advisory.
Technical details
- CVE
- CVE-2026-109619
- Published
- October 21, 2026
- CWE
- CWE-416
- CVSS
- 9.2
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 6.0% chance of an attack attempt in the next 30 days
- Attack evidence
- attacks observed; public exploit on GitHub; Nuclei template
CVSS measures technical severity on a scale up to 10. Attack conditions and urgency are explained above.
EPSS estimates the chance of an exploitation attempt in the next 30 days, not the chance of your server being breached.