PHP patches critical RCE via stale global request state
CVE-2026-109619, rated 9.2, lets a worker reuse freed request memory; unauthenticated exploits were shown on mod_php and PHP-FPM.
The PHP security team has disclosed a critical use-after-free in the core runtime that can yield remote code execution. The flaw is tracked as CVE-2026-109619 and carries a CVSS v4.0 score of 9.2.
PHP keeps global state that can temporarily point into memory belonging to the current request. In some cases that state is not fully reset, or is filled in again after a reset. Once the request finishes and its memory is freed, another request handled by the same worker may read or write the leftover pointers before normal initialization replaces them. That use-after-free can escalate to code execution.
Unauthenticated remote code execution has been demonstrated against Apache mod_php and PHP-FPM, according to Jakub Zelenka of the PHP security team. Exploitability still depends on which state is involved, server configuration, and application behavior.
Affected lines are PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12. Upgrading to those releases or later is the only reliable mitigation; there is no complete generic configuration workaround.