PHP2Shell (CVE-2026-109619)
RCE via stale global state
Also Known as PHP2Shell
Part of the PHP2Shell pair of PHP core flaws fixed on October 21, 2026; this CVE is the stale global state flaw, where request-owned state can outlive its memory and reach a later request on the same worker. Wiz Research combined both flaws into one exploit script named PHP2Shell. PHP rates the risk highest for Apache with mod_php.
Name sources
- Security advisory: Critical remote code execution vulnerabilities, update now (PHP)
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet (Wiz)
- Critical Vulnerabilities in PHP Require Immediate Patching (CISA)
- Two Critical PHP Flaws Could Hand Attackers Your Web Servers (Qualys)
Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NExploitation Context
as of October 23, 2026- Its current EPSS score (5.8%) is higher than that of 20% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| PHP Group | PHP Group PHP | 8.2.* to <8.2.35 8.3.* to <8.3.36 8.4.* to <8.4.27 8.5.* to <8.5.12 |
References
11 Links- http://www.openwall.com/lists/oss-security/2026/10/21/7
- http://www.openwall.com/lists/oss-security/2026/10/21/16
- http://www.openwall.com/lists/oss-security/2026/10/21/17
- http://www.openwall.com/lists/oss-security/2026/10/21/23
- http://www.openwall.com/lists/oss-security/2026/10/22/2
- http://www.openwall.com/lists/oss-security/2026/10/22/14
- http://www.openwall.com/lists/oss-security/2026/10/22/15
- http://www.openwall.com/lists/oss-security/2026/10/22/16
- http://www.openwall.com/lists/oss-security/2026/10/22/19
- http://www.openwall.com/lists/oss-security/2026/10/22/20
Record Details
More from PHP Group
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.