Cyber ·
Claimed PHP 8.2 to 8.5 RCE (CVE-2026-109619) is disputed on a security mailing list
A message on the oss-sec list dated October 21, 2026 questions a Mastodon post about remote code execution in PHP 8.2 to 8.5. According to the report, php.org replied that the case is not a real problem.
On October 21, 2026, a message on the oss-sec mailing list, under a subject referring to CVE-2026-109619, asked whether a problem described in a Mastodon post was a real vulnerability. The description attributed to the post concerns remote code execution in PHP versions 8.2 to 8.5, linked to obsolete global state.
According to the text, which is a machine translation of feed content, Canonical asked php.org in a Matrix conversation. The reported answer was that the issue was unrelated and not a real problem. The message author asked that someone from the PHP security team confirm this publicly. The available excerpt contains no official confirmation, and part of the content was omitted.
To verify, consult the original oss-sec list archive, the original Mastodon post, and the official PHP and CVE database advisories before acting. Do not treat this summary as a diagnosis. Anyone running PHP in production should check the version in use and the advisories from their distribution vendor.
Original source: Re: CVE-2026-109619: RCE no PHP 8.2–8.5 via estado global obsoleto