CVE-2026-109619: PHP2Shell Stale-State Flaw, Advisory Summary and Fix

As of 23 October 2026, CVE-2026-109619 is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, it is not on CISA's Known Exploited Vulnerabilities list, and PHP has added a related informational advisory, CVE-2026-115560, that affects even patched releases under an unusual setup. CVE-2026-109619 is the second PHP2Shell flaw. The PHP project calls it "RCE via stale global state": leftover data from one web request can be reused by a later request on the same PHP worker, which can let an attacker who never logs in read server memory or run code.

The fix is to install a fixed PHP release or your distribution's patched package, restart every worker, and keep session.upload_progress.enabled=0 in place until PHP's next regular release if you don't need that feature.

This is a defender's summary for IT staff and developers. It does not explain how the flaw is triggered.

What PHP Says About CVE-2026-109619

The PHP project's 21 October 2026 announcement describes it in one sentence: "request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it."

The advisory lists the same five weakness types as CVE-2026-109618: CWE-416 Use After Free, CWE-755 Improper Handling of Exceptional Conditions, CWE-824 Access of Uninitialized Pointer, CWE-1325 Improperly Controlled Sequential Memory Allocation and CWE-1419 Incorrect Initialization of Resource.

A note on naming: one research blog's table assigned some findings to the other CVE. PHP's own mapping, used here and on the researchers' php2shell.com site, puts session upload progress and the fatal error backtrace under CVE-2026-109619. For the companion flaw, see our CVE-2026-109618 summary.

How Severe Is It?

PHP's vector is CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N: network reachable, no privileges, no user interaction, high impact, with high attack complexity and attack requirements present. The lower NVD and Red Hat numbers use the older CVSS 3.1 method, so they are not a downgrade of PHP's rating. The 10.0 score that circulated before release was wrong, according to the PHP Foundation.

Who Is at Risk

PHP lists "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed," and says "We consider the risk highest for mod_php." For this CVE, the GitHub advisory adds:

• mod_php and FPM: "Session lifecycle RCE was validated against mod_php and FPM."
• FPM settings passed by the web server: FPM is "conditionally exposed when nginx, Apache mod_proxy_fcgi or another frontend sends PHP_VALUE/PHP_ADMIN_VALUE parameters that produce a diagnostic before request initialization." If your web server passes PHP settings this way, check that none produce warnings.
• FrankenPHP: an early configuration path "was not established in the default configuration of FrankenPHP. This does not make this environment immune."
• Any application: PHP says session upload progress "is enabled by default, and no application call to session_start() is required."

Because this is in the engine, a WordPress, Drupal or Joomla update cannot fix it, and neither can hiding errors. The advisory is direct: "Changing error_reporting, using @, or disabling display_errors or log_errors does not protect against this vulnerability."

Affected and Fixed Versions

NVD's affected-product data for this CVE starts at PHP 5.4.0, and researchers report older branches are affected. Linux distributions patch without changing the upstream number: Ubuntu 24.04 LTS's fixed php8.3 package is 8.3.6-0ubuntu0.24.04.13, which still reports 8.3.6. Use our PHP2Shell fixed versions table and guide to checking your PHP version to confirm what your web server really runs.

Official Interim Settings for CVE-2026-109619

PHP's framing: these "reduce exposure to specific attack paths but do not make an installation safe." The settings for this CVE, quoted exactly from php.net:

1. "Set session.upload_progress.enabled=0 and restart every worker. Use php.ini, an FPM pool or server configuration that applies before request parsing. Do not rely on ini_set() or FPM .user.ini. This blocks the confirmed session paths but not other variants."
2. "On PHP 8.5, set fatal_error_backtraces=0 and restart every worker. This blocks the confirmed fatal backtrace path only."
3. "Remove invalid or deprecated settings applied per request that emit diagnostics before initialization. Hiding diagnostics with error_reporting, display_errors or @ does not help."
4. "Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing and cleanup."

The GitHub advisory adds: "If performance is not a factor, consider limiting the number of requests a worker may execute using pm.max_requests=1." It also says "There is no complete generic configuration mitigation."

Caveats and side effects

Some researchers, including watchTowr and Datadog, warn that ini changes do not fully protect you. That matches PHP's own wording: partial, not complete. Both CVEs' settings are compared in our PHP2Shell interim mitigations guide.

Defender Note: CVE-2026-115560

On 23 October 2026, PHP published an informational advisory, CVE-2026-115560, about session upload progress. PHP says: "We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector." If you set it for CVE-2026-109619, "keep it in place and no further action is needed."

PHP says the issue needs "an unusual combination of configuration and application code," involving a site that changes its session serializer at runtime. Cloudflare notes it "affects fully patched PHP releases, including 8.5.12." CERT-EU says PHP will not issue an out-of-band release for it. As of 23 October, NVD has no record for CVE-2026-115560 yet.

Restart Every Worker

Each setting above, and the fix itself, only takes effect in fresh PHP processes. That matters more for this CVE than most, because the problem is state carried between requests on a running worker. Examples for Debian or Ubuntu (replace 8.3 with your version):

sudo systemctl restart php8.3-fpm
sudo systemctl restart apache2

Also restart long-running PHP workers and redeploy containers on a fixed image. On hosted plans, ask your host to confirm.

Detection Signs

There are no official indicators of compromise. Behavioral signs named by vendors, checked from at least 17 October 2026:

• Sophos: "requests containing the PHP_SESSION_UPLOAD_PROGRESS field" and "newly created or modified PHP files that may indicate web shells."
• Wiz: "unexpectedly large or malformed PHPSESSID response cookies, and unexplained PHP worker churn."
• Beazley: "child processes launched by PHP or web server workers."
• CISA: "PHP worker processes launching shells or downloading tools."

Two cautions from PHP's advisory: "absence of an error in logs is not proof of safety," and for an audit, "Enable log_errors=On, a functional error_log, and error_reporting=E_ALL in startup configuration during an isolated audit." Because memory disclosure is a confirmed impact, Beazley advises you "treat secrets held by an affected PHP process as potentially exposed." That means rotating database passwords, API keys and admin credentials, as covered in our access control and 2FA guide. If you find signs of a break-in, start with our PHP2Shell compromise check and how to remove malware.

Timeline and Primary Sources

Read the primary sources: the php.net announcement, GitHub advisory GHSA-6wmf-4rv5-p3rp, and the NVD entry for CVE-2026-109619.

Conclusion

As of 23 October 2026, CVE-2026-109619 is a critical PHP flaw that can expose memory or allow code execution through state left over between requests. Install a fixed release or patched package, restart every worker, set session.upload_progress.enabled=0 in php.ini or the FPM pool if you don't use it, and keep it off until PHP's next regular release because of CVE-2026-115560. Need help with the server side? Our emergency PHP patching team can work with your host. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions