CVE-2026-109619: PHP Stale Internal Request-State Vulnerability

Huntress describes CVE-2026-109619 as a remote code execution flaw caused by PHP retaining request-specific state after its backing memory has been freed[2]. According to Huntress, if the same worker processes a later request, PHP may access that stale state before the normal initialization resets it.[2]Rapid7 reports that both flaws have a CVSSv4 score of 9.2[3]. It adds that all installations serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.[3]According to Huntress, details of the two vulnerabilities leaked online before their coordinated disclosure and before patches were released[2] on October 20. Huntress says the PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35[2] on October 21.Google Cloud reports that the PHP project is not releasing fixes for PHP 8.1 or earlier, which have reached end of life.[4] Rapid7, however, says that for this incident, PHP has supplied limited source backports for PHP 7.4, 8.0, and 8.1.[3]Rapid7 says multiple public proof-of-concept (PoC) exploits[3] now exist, but that none appears to be broadly reliable.[3]Palo Alto Networks' Unit 42 says Cortex Xpanse has found over 22.6 million exposed instances potentially vulnerable[5] to the two flaws.CISA says organisations that cannot patch, or that still run PHP 8.1 or older, should take PHP-based systems offline until they can be patched or updated.[1]