CVE-2026-109619

Name	CVE-2026-109619
Description	PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4848-1, DSA-6574-1
Debian Bugs	1151516

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php8.2 (PTS)	bookworm	8.2.32-1~deb12u1	vulnerable
	bookworm (security)	8.2.35-1~deb12u1	fixed
php8.4 (PTS)	trixie	8.4.24-1~deb13u1	vulnerable
	trixie (security)	8.4.27-1~deb13u1	fixed
	forky	8.4.26-1	vulnerable
	sid	8.4.27-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
php8.2	source	bookworm	8.2.35-1~deb12u1	DLA-4848-1
php8.2	source	(unstable)	(unfixed)
php8.4	source	trixie	8.4.27-1~deb13u1	DSA-6574-1
php8.4	source	(unstable)	8.4.27-1		1151516

https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
https://www.php2shell.com/