PHP RCE actively exploited in the wild (CVE-2026-109619) [PoC]

Actively exploited in the wild - CVE-2026-109619 is a critical remote code execution flaw in PHP (all versions that reuse global state across requests, including server module and persistent-process builds) that lets a remote, unauthenticated attacker execute arbitrary code on the server. No official patch is confirmed yet - apply the mitigations below immediately.

Overview

PHP keeps a set of global variables that briefly point into per-request memory. When a request finishes, that memory is freed, but in certain scenarios the global state is not fully reset, or it gets repopulated afterward. The result is a dangling pointer: for the next request, PHP may still read or branch on data that lives in memory the process no longer owns.

Multiple strategies can trigger this condition. An attacker who can reach the interpreter - through a web request on a typical PHP-FPM, Apache mod_php, or long-running worker setup - can shape the heap and steer that stale state. Because the stale data is attacker-influenced, the interpreter can be induced to execute attacker-controlled code. That makes this a remote, unauthenticated code execution issue, which is why it carries a CVSS score of 9.2 and is being tracked as actively exploited by CISA.

Impact

Any deployment that shares an interpreter process across requests is in scope. An attacker who lands this bug gains code execution in the web server’s context, which typically means full access to application secrets, database credentials, session data, and the ability to pivot into internal networks. Because exploitation abuses state left over between requests, one request can poison the next, so even low-value endpoints on a shared worker pool can become entry points. The high attack complexity reflects the need for heap shaping rather than reliable one-shot exploitation, but real-world attacks have confirmed it is achievable.

Remediation and Mitigation

• Update PHP to the latest release from php.net as soon as a patched version is published in your branch (8.2, 8.3, 8.4, and 8.5). Treat this as urgent given active exploitation.
• If you cannot patch immediately, run PHP in a mode that does not share interpreter state across requests where feasible, and isolate worker pools so a single compromised process has less reach.
• Segment PHP-FPM workers with per-pool permissions, and restrict the filesystem and network access available to the web user.
• Rotate any credentials or secrets that lived in memory reachable by a web worker, and review logs for anomalous requests to low-traffic endpoints.
• Track the vendor advisory and CISA KEV entry for the authoritative fixed-version list.

Security Insight

This bug is a reminder that long-lived interpreter processes are a shared-memory surface, and cross-request state hygiene is a hard promise to keep. It echoes earlier PHP and engine-level use-after-free episodes, but the active-exploitation status raises the stakes: a flaw that only matters across requests is exactly the kind attackers can test cheaply on public services. Expect copycat variants to surface as researchers probe other language runtimes with persistent worker pools. For related persistence risks, see Apple fixes iOS CoreGraphics zero-day CVE-2026-86950 and LangChain, LangGraph Flaws Expose Files, Secrets,.

Further Reading

• Apple fixes iOS CoreGraphics zero-day CVE-2026-86950
• iOS Bug Let FBI Recover Deleted Signal Messages
• LangChain, LangGraph Flaws Expose Files, Secrets,
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs