CVE-2026-109619: PHP RCE via stale global state

What goes wrong, at the level the vendor published

The PHP Foundation says a fatal error at the wrong point can leave internal state pointing at memory that belonged to a previous request. A later request on the same worker can then use that freed memory. The Foundation says a use-after-free and a worker crash were confirmed, and that the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php. The UK NCSC’s description matches the php.net sentence: state survives after its backing memory is freed, and a later request on the same worker may use it before initialization resets it.

The University of Toronto advisory names session upload progress, which is enabled by default, as one confirmed path. The PHP project’s interim guidance says setting session.upload_progress.enabled=0 blocks the confirmed session paths and does not block other variants. Disabling that setting is a mitigation, not a fix. We are not describing how a request reaches the fatal-error window.

mod_php and PHP-FPM

Expel, attributing the result to PHP, says PHP demonstrated this CVE against PHP-FPM in a case where the application’s own code can be pushed into a fatal error. FPM exposure depends on the application and the setup, and PHP still considers FPM installations at risk. mod_php remains the configuration the PHP project calls highest risk, including for this pair of bugs as a whole. The Canadian Cyber Centre repeats that assessment: a demonstrated exploit on mod_php allows an unauthenticated request to trigger the vulnerability before application-level code runs.

Fix

There is no separate patch. Install the 21 October releases and restart every worker. On PHP 8.5 the project also lists fatal_error_backtraces=0 as an interim measure that blocks only the confirmed fatal-backtrace path. Hiding diagnostics with error_reporting, display_errors, or the @ operator does not help, according to the php.net advisory. Google Cloud lists vulnerable versions as 5.4 through 8.5.11 for the pair; see the version page for how that sits next to the branches PHP actually shipped fixes for.