Cyber ·
Advisory CVE-2026-109619: remote code execution in PHP 8.2 to 8.5 from obsolete global state
On October 22, 2026, a comment on the oss-sec list addressed CVE-2026-109619, reported as remote code execution in PHP 8.2 to 8.5 caused by obsolete global state. The PHP team said it is aware of the report and, for now, has no new plans.
This Radar item collects a security update published as a reply in the oss-sec list feed. The subject is CVE-2026-109619, described in the title as remote code execution (RCE) in PHP versions 8.2 to 8.5, with origin in obsolete global state. The available text is a machine translation and gives no further technical details, such as exploitation conditions, severity or fixed versions. The comment states that the PHP team is aware of the report and that, for now, there are no new plans. The post is attributed to a list participant on October 22. To assess the case, consult the original oss-sec list archive, the comment page on the issue platform cited in the source, and the official channels of the PHP project and your distribution. Confirm the CVE identifier in the official vulnerability database before making decisions. If your organization uses these versions, check whether patches or distribution guidance are available.
Original source: Re: CVE-2026-109619: RCE no PHP 8.2–8.5 por estado global obsoleto