Stale global state use-after-free in PHP core gives unauthenticated remote code execution (CVE-2026-109619)
VulnCheck's canary sensors recorded exploitation attempts on 2026-10-21 and 2026-10-22, other firms saw attempts before the emergency 8.2.35/8.3.36/8.4.27/8.5.12 releases shipped yesterday, and public exploits exist — any internet-facing PHP host still on an older build is now exposed to code execution as the web server user.
PHP worker processes retain error, session, object and extension state that points into memory owned by a single request; when that state is not reset before the request memory is freed, the next request can touch it during early initialization, producing a use-after-free that a crafted heap layout turns into full remote code execution. One of the two flaws tracked as PHP2Shell, it affects every supported PHP branch and needs no authentication or user interaction.
Affected: PHP < 8.2.35; PHP 8.3.0 – 8.3.35; PHP 8.4.0 – 8.4.26; PHP 8.5.0 – 8.5.11
How to Test
Confirm the PHP version on every web host, container image and PHP-FPM pool against the fixed builds 8.2.35, 8.3.36, 8.4.27 and 8.5.12 — anything lower is vulnerable, including distribution packages that have not yet backported the fix. Deploy the Snort rules Talos published in the Community Ruleset for both PHP2Shell CVEs and review web server and PHP-FPM logs since 2026-10-21 for the malformed request patterns described in the ellio.tech and AWS write-ups, as well as unexpected worker crashes, out-of-memory errors or new processes spawned by the web server user, which the public exploits produce when they land or fail.
How to Patch
Upgrade to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (the project's out-of-cycle security release of 2026-10-21) and rebuild any container images that bundle PHP. Where the upgrade cannot land immediately, follow the maintainers' and NCSC's guidance to take exposed PHP applications offline until patched.