Cyber ·
CVE-2026-109619: doubt over affected versions of PHP 8.2 to 8.5 RCE
A reply on the oss-sec list questions which PHP versions are affected by CVE-2026-109619, a remote code execution flaw tied to stale global state in versions 8.2 to 8.5.
On 22 October 2026, Markus Gschwendt posted to the oss-sec list a reply to the discussion of CVE-2026-109619, a remote code execution (RCE) vulnerability in PHP 8.2 to 8.5 linked to stale global state. The reply questions the specific list of affected versions. It cites a Wiz text stating that almost all PHP versions are affected by at least one of the issues, including releases going back to PHP 5.4. According to the quoted passage, the vulnerabilities may let unauthenticated attackers execute code on affected servers or read sensitive process memory, which may contain passwords and authentication tokens. The discussion itself leaves the exact per-version scope open. To verify, consult the original thread in the public oss-sec archive, the PHP project's security communication, and the cited Wiz text, comparing dates and version ranges in each source. Because this is a security advisory, Rota Nacional does not resolve or patch the flaw. For those running PHP, the priority is to inventory installations and apply the fixes indicated by the vendor or project.
Original source: Re: CVE-2026-109619: RCE no PHP 8.2–8.5 por estado global obsoleto