PHP CVE-2026-109619: critical RCE exploited in the wild

What it is and who is affectedThe PHP Group has disclosed a critical flaw tracked as CVE-2026-109619, officially named the PHP Stale Internal Request-...

What it is and who is affected

The PHP Group has disclosed a critical flaw tracked as CVE-2026-109619, officially named the PHP Stale Internal Request-State Vulnerability. According to the National Vulnerability Database (NVD) of NIST, PHP keeps global state that temporarily points into request memory; in certain scenarios that state is not reset correctly or is repopulated after being reset, so it can still refer to request memory once it has been freed. Later requests may then read or branch on this stale state before it is fully initialised. Several strategies can trigger the condition and lead to remote code execution (RCE), and CISA describes it as reachable without authentication.

The severity is CVSS 4.0 9.2, CRITICAL, with a network attack vector. The underlying weaknesses are classified as CWE-416, CWE-755, CWE-824 and CWE-1325. It was published in the NVD on 21 October 2026.

The affected PHP versions listed by the NVD are:

From 5.4.0 inclusive up to, but not including, 8.2.35
From 8.3.0 inclusive up to, but not including, 8.3.36
From 8.4.0 inclusive up to, but not including, 8.4.27
From 8.5.0 inclusive up to, but not including, 8.5.12

The NVD also lists downstream products that embed the affected runtime, including Siemens RUGGEDCOM APE1808 firmware and multiple PAN-OS configurations from Palo Alto Networks (from 10.2.0 up to 10.2.7, plus several 10.2.7 hotfix builds), among hundreds of further configurations. In practice, any business running PHP behind a WordPress, PrestaShop or Joomla site, or on its own servers, should treat this as directly relevant.

Why it is urgent

This is not a theoretical risk. CISA added CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalogue on 26 October 2026, which means it is already being exploited in real attacks. The deadline CISA set for US federal agencies to remediate is 29 October 2026, only three days later, a sign of how seriously the flaw is being treated.

CISA requires organisations to apply mitigations in line with vendor instructions and to follow its BOD 26-04 guidance on prioritising security updates based on risk, together with its forensics triage requirements. For cloud services, the same guidance applies, or the product should be discontinued if no mitigation is available. Each organisation is responsible for evaluating how exposed its assets are to the internet. The KEV entry does not record known use in ransomware campaigns, but that does not lower the priority: unauthenticated RCE on a public-facing runtime is about as bad as it gets.

What to do today

Inventory first. Find every place PHP runs: web servers, containers, virtual machines, shared hosting, and appliances that bundle a runtime. Record the exact version, not just the major branch.
Compare against the affected ranges. If you are on any version inside the intervals above, you are exposed. Pay particular attention to older 5.4 and 7.x installations that were never upgraded.
Update according to the vendor advisory. The PHP project published a security advisory (GHSA-6wmf-4rv5-p3rp) covering mitigation and the fixed releases; apply exactly what it states for your branch. Do not assume a version number from a third-party summary.
Look for signs of intrusion. Because exploitation can happen without credentials, review web server and PHP logs for unexpected POST requests, unusual child processes spawned by the web server user, modified files in upload directories, and new scheduled tasks or cron entries. If you find anything, treat the host as compromised and preserve evidence before cleaning.
Reduce what is exposed. Restrict administrative panels and staging environments to known IP ranges, remove unused extensions, and make sure error output is not leaking internal paths. On shared hosting, ask the provider which PHP version your plan is actually running.

How a cybersecurity team such as ALMC's can help

For small and mid-sized companies in Barcelona, Lleida, Tarragona or Girona, the hard part is rarely reading the advisory; it is knowing what is running where and acting before someone else does. At ALMC we start with a security audit and pentesting to map the real attack surface, then harden servers and close the gaps that matter. For WordPress, PrestaShop and Joomla sites we handle ongoing maintenance and security patching so that PHP and extension updates do not pile up between projects, and we monitor for suspicious activity with incident response when something looks wrong. If a site has already been hacked, we repair it, remove the backdoor and restore a clean state from backup. All of this is delivered in line with GDPR obligations and documented so you can justify your decisions to clients and auditors.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.