// CVE

CVE-2026-109619

Critical 9.2 Exploited (KEV)

PHP Group PHP

9.2CVSS
100%EPSS
YesCISA KEV

Summary

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it…

Published: 2026-10-21 · In KEV since: 2026-10-26

Analysis

🔴 Critical — actively exploited

Weakness: Use After Free (CWE-416). Uses freed memory; can lead to code execution.

How it's exploited: Exploitable over the network (internet-reachable), unauthenticated, no user interaction, with high complexity.

Impact: Full compromise (confidentiality, integrity and availability).

Status: Active exploitation confirmed by CISA (KEV).

How to defend:
  • Patch now: it is in CISA's actively-exploited catalog (KEV), with a deadline.
  • Reduce exposure: keep it off the internet; firewall, VPN or network segmentation.
  • Detect: turn this CVE into detection rules.

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

The vector encodes how it's exploited (translated above, in the analysis). Break it down in the CVSS tool →

🔗 NVD record CISA KEV 🌉 CVE → detection 🎯 Am I exposed? ⚖️ Prioritize patch

← Back to the Threat Radar

Sources: CISA KEV · EPSS · FIRST.org · NVD. Analysis derived from the CVSS vector and exploitation status (no AI). Informational; always verify against the vendor's official advisory.