CVE-2026-109619

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel.

A Remote Code Execution (RCE) vulnerability (CVE-2026-109619) has been identified in how PHP resets global state between requests in long-running workers, which allows an attacker to leave state that points into freed request memory and have a later request on the same worker use it, causing a use after free that can lead to unauthenticated code execution. The PHP project tracks this issue as GHSA-6wmf-4rv5-p3rp.

Per MITRE CWE-416: The product reuses or references memory after it has been freed.

This issue affects all versions of PHP before 8.2.35, versions 8.3.0 through 8.3.35, versions 8.4.0 through 8.4.26, and versions 8.5.0 through 8.5.11, including End-of-Life release lines such as PHP 7.4, 8.0 and 8.1. The strongest confirmed case applies only to PHP 8.5.

Details

Module Info

• Product: PHP
• Affected packages: php-src (PHP core)
• Affected versions: <8.2.35, >=8.3.0 <8.3.36, >=8.4.0 <8.4.27, >=8.5.0 <8.5.12
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12
  • ZendPHP through HeroDevs

Vulnerability Info

This Critical-severity vulnerability is found in PHP core in all versions before 8.2.35, 8.3.0 through 8.3.35, 8.4.0 through 8.4.26, and 8.5.0 through 8.5.11. The PHP project scores it 9.2 under CVSS 4.0 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

A PHP worker keeps global state, such as error, session, object and extension state, across the requests it serves. Some of that state points into memory owned by a single request and must be reset before the request's memory is released. A fatal error, including a parse failure, an uncaught error, a failed require, Maximum execution time exceeded or memory exhaustion, can abandon an operation before it performs that reset. A nonfatal diagnostic raised during a late shutdown stage can also repopulate error state after it was cleared. The request memory is then freed while the global still refers to it.

Exploitation needs a producer that leaves request-owned state behind and a consumer that uses it in a later request on the same worker, before normal request initialization replaces it. The advisory confirms two consumers:

• INI diagnostics before request initialization. A warning, notice or deprecation raised while applying per-directory or per-request INI settings reads the stale error state. Examples include deprecated settings such as auto_detect_line_endings=1, explicitly set mbstring or iconv encoding settings, and invalid values for settings such as memory_limit or date.timezone. With Apache mod_php, .htaccess and php_value/php_flag directives are applied at this point. PHP-FPM is exposed when the frontend sends PHP_VALUE or PHP_ADMIN_VALUE parameters that produce a diagnostic. Turning off display_errors or log_errors, changing error_reporting, or using @ does not help, because the state is read before PHP decides whether to report the message.
• Session upload progress. Upload progress tracking, enabled by default and active without any session_start() call, runs session handling before normal session initialization and can consume session or decoder state left by an interrupted request.

Two cases are confirmed end to end. On PHP 8.5 with fatal_error_backtraces enabled, the backtrace stored for a fatal error is never reset at shutdown, and a diagnostic in the next request reaches it; this is the basis of the confirmed remote code execution against mod_php. In the session upload progress case, an upload publishes session and decoder state, an out-of-memory error or other fatal error prevents its reset, and a later upload progress operation treats the freed memory as valid; remote code execution through this path was validated against both mod_php and PHP-FPM. Other request state in supported branches may be reachable depending on the application and extensions.

The confirmed impact is unauthenticated heap use after free, memory disclosure and remote code execution with the privileges of the web server worker. The producing and consuming requests must reach the same worker; more workers and worker recycling lower the success rate per request but do not remove the condition.

The fix resets the affected request-owned global state, including the wider error, exception, object and extension state, so that it cannot survive into operations that run before the next request is initialized.

Mitigation

The PHP project states that updating to a release with the complete state reset patch is the only reliable mitigation, and that no configuration change covers every path. PHP 7.4, 8.0 and 8.1 are End-of-Life and do not receive community security updates.

Until an upgrade is possible, the advisory recommends these steps, each followed by a restart of every worker:

• On PHP 8.5, set fatal_error_backtraces=0 administratively. This removes the producer in the confirmed mod_php case.
• Set session.upload_progress.enabled=0 if the feature is not needed. This blocks the confirmed session lifecycle path, and the advisory suggests keeping it off even after patching.
• Remove diagnostics from INI settings applied per directory or per request, preferring php.ini, FPM pool or server configuration applied at startup, and eliminate fatal errors and execution timeouts on paths an attacker can reach.
• Where performance allows, limit each worker to one request with pm.max_requests=1.

Also apply the mitigations for the related advisory, GHSA-w8hw-w9fx-j79w (CVE-2026-109618).

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12, or later.
• Leverage a commercial support partner like ZendPHP through HeroDevs for post-EOL security support.

Credits

• lcfr-hax (finder)
• sagitzadik-wiz (finder)
• tomash-areion (finder)
• amyb-oai (finder)
• arnaud-lb (remediation)
• iluuu1994 (remediation)
• bukka (remediation)
• ndossche (remediation)