CVE-2026-109619
KEV EPSS 100.0%Vendor patching same-day, Cloudflare deployed, defender triage underway; KEV absence and unconfirmed "active exploits" claim prevent higher score.
What: PHP global state memory corruption leading to use-after-free and remote code execution across versions 8.2–8.5; affects ~70% of websites running PHP.
Why it matters: Vendor-confirmed critical RCE with patches released same day (2026-10-21); PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 patched. Cloudflare WAF deployed protection. JVN and security vendors (Detectify) actively flagging. Post claims exploits active in wild, though no confirmed KEV listing or public PoC visible in excerpts.
Where it's seen: Coordinated vendor advisories, security researcher amplification, vendor tool updates (Cloudflare WAF, Detectify), Japanese and international security agencies (JVN), urgent update guidance across Bluesky and tech media.
RISK: CRITICAL — Unauthenticated RCE in ~70% of web infrastructure; same-day patch signals urgency.
Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).