CVE-2026-109619: exploitation status and patch state CVE-2026-109619 · CVSS 9.8 CRITICAL · EPSS 100.0% · patch available
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Is CVE-2026-109619 exploited? Not in the CISA KEV catalog. EPSS puts exploitation in the next 30 days at 100.0%. Public exploit code: none found in monitored sources. Which products and versions are affected? PHP Group · PHP · >= 8.2.*, < 8.2.35, >= 8.3.*, < 8.3.36, >= 8.4.*, < 8.4.27, >= 8.5.*, < 8.5.12 siemens · ruggedcom ape1808 firmware paloaltonetworks · pan-os · >= 10.2.0, < 10.2.7, 10.2.7, 10.2.8, 10.2.9, 10.2.10, 10.2.11, +44 more paloaltonetworks · panorama virtual appliance Is there a patch? Yes. Update to one of these or later:
PHP 8.2.* 8.2.35 PHP 8.3.* 8.3.36 PHP 8.4.* 8.4.27 PHP 8.5.* 8.5.12
From PHP Group's CVE record · PHP Group advisory
pan-os 10.2.0 10.2.7 pan-os 11.1.0 11.1.4 pan-os 11.2.0 11.2.4 pan-os 12.1.0 12.1.4 pan-os 12.2.0 12.2.4
From NVD's analysis
What PlainSec published about CVE-2026-109619 Primary sources KEV and EPSS are re-checked daily. Record last updated 2026-10-26.
CVE-2026-109619: exploitation status and patch state CVE-2026-109619 · CVSS 9.8 CRITICAL · EPSS 100.0% · patch available
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Is CVE-2026-109619 exploited? Not in the CISA KEV catalog. EPSS puts exploitation in the next 30 days at 100.0%. Public exploit code: none found in monitored sources. Which products and versions are affected? PHP Group · PHP · >= 8.2.*, < 8.2.35, >= 8.3.*, < 8.3.36, >= 8.4.*, < 8.4.27, >= 8.5.*, < 8.5.12 siemens · ruggedcom ape1808 firmware paloaltonetworks · pan-os · >= 10.2.0, < 10.2.7, 10.2.7, 10.2.8, 10.2.9, 10.2.10, 10.2.11, +44 more paloaltonetworks · panorama virtual appliance Is there a patch? Yes. Update to one of these or later:
PHP 8.2.* 8.2.35 PHP 8.3.* 8.3.36 PHP 8.4.* 8.4.27 PHP 8.5.* 8.5.12
From PHP Group's CVE record · PHP Group advisory
pan-os 10.2.0 10.2.7 pan-os 11.1.0 11.1.4 pan-os 11.2.0 11.2.4 pan-os 12.1.0 12.1.4 pan-os 12.2.0 12.2.4
From NVD's analysis
What PlainSec published about CVE-2026-109619 Primary sources KEV and EPSS are re-checked daily. Record last updated 2026-10-26.