Vulnerability details
CVE-2026-109619
Actively exploited
PHP Group PHPSiemens AMIS TSSiemens Energy EngageSiemens Local Monitoring bt-monitoring-vmSiemens RUGGEDCOM APE1808Siemens Spectrum Power 3
RCE via stale global state
CVSS 4.0
9.2Critical
Official description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Related news
-
Week in review: Refrigeration cyberattacks hit European retailers again, Patch Tuesday forecast
Help Net Security · 2 d ago
-
November 2026 Patch Tuesday forecast: Old software continues to bite
Help Net Security · 4 d ago
-
Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
The Register · 12 d ago
-
CISA confirms PHP2Shell under attack as researchers clock successful exploits
The Register · 14 d ago
-
PHP2Shell: What to know about two critical PHP flaws
WeLiveSecurity · 15 d ago
-
New Serious PHP Vulnerabilities Released and Patched
Schneier on Security · 19 d ago
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.2Critical | 4.0 | CVEProject cvelistV5 (CNA) (php) | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| PHP Group | PHP | 8.2.* ≤ v < 8.2.35 | CVEProject cvelistV5 (CNA) |
| PHP Group | PHP | 8.3.* ≤ v < 8.3.36 | CVEProject cvelistV5 (CNA) |
| PHP Group | PHP | 8.4.* ≤ v < 8.4.27 | CVEProject cvelistV5 (CNA) |
| PHP Group | PHP | 8.5.* ≤ v < 8.5.12 | CVEProject cvelistV5 (CNA) |
| Siemens | AMIS TS | All | CVEProject cvelistV5 (CNA) |
| Siemens | Energy Engage V2.0SP9 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Energy Engage V3.1SP1 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Local Monitoring bt-monitoring-vm | v < V20261103 | CVEProject cvelistV5 (CNA) |
| Siemens | RUGGEDCOM APE1808 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Spectrum Power 3 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Spectrum Power 4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Spectrum Power 4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Spectrum Power 4 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Spectrum Power 7 | All | CVEProject cvelistV5 (CNA) |
| Siemens | Spectrum Power TG | All | CVEProject cvelistV5 (CNA) |
| Siemens | blueplanet 360 NX3 M6 WM OD IISX | All | CVEProject cvelistV5 (CNA) |
| Siemens | blueplanet 360 NX3 M6 WM OD IISX - S | All | CVEProject cvelistV5 (CNA) |
References and advisories
19- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp vendor-advisory
- https://www.wiz.io/blog/php2shell-php-rce third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619 government-resource
- https://php2shell.delftintellab.com/ third-party-advisory
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/ third-party-advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/7
- http://www.openwall.com/lists/oss-security/2026/10/21/16
- http://www.openwall.com/lists/oss-security/2026/10/21/17
- http://www.openwall.com/lists/oss-security/2026/10/21/23
- http://www.openwall.com/lists/oss-security/2026/10/22/2
- http://www.openwall.com/lists/oss-security/2026/10/22/14
- http://www.openwall.com/lists/oss-security/2026/10/22/15
- http://www.openwall.com/lists/oss-security/2026/10/22/16
- http://www.openwall.com/lists/oss-security/2026/10/22/19
- http://www.openwall.com/lists/oss-security/2026/10/22/20
- http://www.openwall.com/lists/oss-security/2026/10/23/4
- https://cert-portal.siemens.com/productcert/html/ssa-566512.html
- https://cert-portal.siemens.com/productcert/html/ssa-566435.html
- https://cert-portal.siemens.com/productcert/html/ssa-166980.html
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-21
- Last updated
- 2026-11-05
- State
- Published
- Assigner (CNA)
- php
- Kolun priority
- 79 · High
CISA KEV catalog
- Date added
- 2026-10-26
- Due date
- 2026-10-29
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
99.99%
Probability of exploitation in 30 days
99.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-416Use after free
- CWE-755Improper Handling of Exceptional Conditions
- CWE-824Access of uninitialized pointer
- CWE-1325Improperly controlled sequential memory allocation
- CWE-1419Incorrect Initialization of Resource