Quantum Secular Labs / Blog / Advisories

CVE-2026-109619: PHP Stale Internal Request-State Vulnerability

CVE-2026-109619 is rated critical with a CVSS v4.0 base score of 9.2 and affects PHP Group PHP, along with 11 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-26, which means exploitation in the wild has been observed.

Vulnerability description

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Severity breakdown

CVSS v4.0 9.2: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Attack vector: Network. Exploitable remotely over the network.
  • Attack complexity: High. Success depends on conditions or defences that must be bypassed.
  • Attack requirements: Present. A specific deployment or execution condition must exist.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Confidentiality impact (vulnerable system): High. Total loss of confidentiality.
  • Integrity impact (vulnerable system): High. Total loss of integrity.
  • Availability impact (vulnerable system): High. Total loss of availability.
  • Confidentiality impact (subsequent systems): None. No confidentiality impact beyond the vulnerable system.
  • Integrity impact (subsequent systems): None. No integrity impact beyond the vulnerable system.
  • Availability impact (subsequent systems): None. No availability impact beyond the vulnerable system.

Underlying weakness

CWE-416: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

CWE-755: Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

CWE-824: Access of Uninitialized Pointer

The product accesses or uses a pointer that has not been initialized.

Affected products

  • PHP: from 5.4.0 before 8.2.35; from 8.3.0 before 8.3.36; from 8.4.0 before 8.4.27; from 8.5.0 before 8.5.12
  • Siemens Ruggedcom Ape1808 Firmware: all versions listed by NVD
  • Paloaltonetworks Pan OS: from 10.2.0 before 10.2.7; 10.2.7; 10.2.7 h1; 10.2.7 h10; 10.2.7 h11; 10.2.7 h12; 10.2.7 h13; 10.2.7 h14; 10.2.7 h15; 10.2.7 h16; 10.2.7 h17; 10.2.7 h18
  • Paloaltonetworks Panorama Virtual Appliance: all versions listed by NVD
  • Siemens Amis Ts: all versions listed by NVD
  • Siemens Blueplanet 360 Nx3 M6 Wm Od Iisx S Firmware: all versions listed by NVD
  • Siemens Energy Engage: 2.0 service_pack9; 3.1 service_pack1
  • Siemens Spectrum Power 3: all versions listed by NVD
  • Siemens Spectrum Power 4: all versions listed by NVD
  • Siemens Spectrum Power 7: all versions listed by NVD
  • Siemens Spectrum Power Tg: all versions listed by NVD
  • Siemens Blueplanet 360 Nx3 M6 Wm Od Iisx Firmware: all versions listed by NVD

References