CVE-2026-109619 is 1 of the 2 PHP2Shell flaws in PHP, rated critical (CVSS v4.0 9.2). Leftover state from 1 request can be reused by the next, letting an attacker run code. PHP fixed it on October 21, 2026 in 8.2.35, 8.3.36, 8.4.27, 8.5.12; earlier releases on those lines have it, and PHP 8.1 and older got a source-code fix only.
- CVSS v4.0 score, rated critical
- 9.2
- fixed releases out
- Oct 21, 2026
- PHP lines with a fixed release
- 4
What is CVE-2026-109619?
Leftover state from 1 request can be reused by the next, letting an attacker run code. It's 1 of 2 flaws known together as PHP2Shell; the other is CVE-2026-109618. PHP fixed both on October 21, 2026.
- In technical terms: Remote code execution via stale global state across requests on the same worker.
- Severity: CVSS v4.0 9.2, rated critical.
- Advisory: GitHub GHSA-6wmf-4rv5-p3rp.
- Where it runs: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
Which PHP versions are affected by CVE-2026-109619?
| PHP line | Affected releases | Fixed in |
|---|---|---|
| PHP 8.5 | 8.5.0 to 8.5.11 | 8.5.12 |
| PHP 8.4 | 8.4.0 to 8.4.26 | 8.4.27 |
| PHP 8.3 | 8.3.0 to 8.3.35 | 8.3.36 |
| PHP 8.2 | 8.2.0 to 8.2.34 | 8.2.35 |
| PHP 7.4 | All (end of life) | Source-code fix only, no release |
| PHP 8.0 | All (end of life) | Source-code fix only, no release |
| PHP 8.1 | All (end of life) | Source-code fix only, no release |
What to do
- Find out whether your website runs PHP, and which version. PHP Scanner shows what your server reports.
- Ask your host or developer to update to the fixed release for your line (8.2.35, 8.3.36, 8.4.27, 8.5.12) and restart PHP.
- If you're on PHP 8.1 or older, plan a move to a supported version.
- If you can't update today, ask about PHP's temporary workarounds below.
Temporary workarounds for CVE-2026-109619
These close only some attack paths. Updating PHP is the only full fix. Restart every PHP worker after each change.
Turn off upload progress tracking, then restart every PHP worker.
session.upload_progress.enabled = 0
On PHP 8.5 only, turn off fatal error backtraces, then restart every PHP worker.
fatal_error_backtraces = 0
Is it being exploited?
Proof-of-concept code is reportedly public, and security researchers reported attempts to use it within days of the fix.
Questions people ask
Is my website affected by CVE-2026-109619?
Only if it runs PHP from before the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Sites on hosted platforms like Shopify or Webflow don't run PHP you manage.
Does updating WordPress fix CVE-2026-109619?
No. The flaw is in PHP, which your host or developer updates. Keep WordPress updated too, but it's a separate job.
What's the difference between CVE-2026-109619 and CVE-2026-109618?
Leftover state from 1 request can be reused by the next, letting an attacker run code. A memory error while PHP reads form data can let an attacker run their own code. Both are fixed by the same PHP releases.
Sources
- PHP: security release announcement, October 21, 2026
- The PHP Foundation: today's PHP security release
- GitHub advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- GitHub advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- Canadian Centre for Cyber Security: AL26-026
- Datadog Security Labs: PHP2Shell analysis
- The Hacker News: exploit attempts reported
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.