HIGHCVSS v3.1 8.1Vulnerability

CVE-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Properties

Severity
HIGH
Nvd fetched at
2026-10-22T22:14:18.200859+00:00
Epss score
0.05757
Cvss score
8.1
Cvss severity
HIGH
Retrieved at
2026-10-22T22:17:33+00:00
Score
8.1
Last source
FIRST EPSS
Cvss version
3.1
Cve id
CVE-2026-109619
Cvss vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
First seen by Signal
2026-10-21T22:34:38+00:00
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published at
2026-10-21T14:17:09.823
Last modified
2026-10-22T21:17:14.357
Epss percentile
0.93049

Related Entities (10)

MENTIONED_IN (5)

→[Campaign]INC and The Gentlemen Ransomware: Exposed AI Infrastructure
→[Campaign]PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
→[Campaign]Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
→[Campaign]"Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities
→[Campaign]Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware

HAS_WEAKNESS (4)

→[Weakness]Improper Handling of Exceptional Conditions
→[Weakness]Use After Free
→[Weakness]Access of Uninitialized Pointer
→[Weakness]Improperly Controlled Sequential Memory Allocation

AFFECTS_PRODUCT (1)

→[Product]cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-109619 (CVSS v3.1 8.1) — Ninja Signal Threat Intelligence | Ninja Signal