Cyber ·
CVE-2026-109619: possible PHP 8.2 to 8.5 RCE from stale global state
A security item from the oss-sec feed, published on October 22, 2026, describes a remote code execution flaw in PHP 8.2 to 8.5 caused by stale global state. A reply in the same thread claims versions from 5.4.0 onward are also affected.
This material is a security item from the oss-sec discussion feed, published on October 22, 2026. The title identifies CVE-2026-109619 as a remote code execution (RCE) flaw in PHP versions 8.2 to 8.5, caused by stale global state. The available text is an automatic translation of a reply in the thread. That reply states that the flaw affects version 5.4.0 and all later versions. The same reply repeats that the affected versions are 5.4.0 and all newer ones. This claim comes from a discussion participant and, in the supplied text, is not shown as official confirmation from the PHP project or a CVE database. The material gives no technical details on the attack vector, exploitation conditions, packages, or fixes. To verify, open the original thread in the public oss-sec archive, search for CVE-2026-109619 in official vulnerability sources, and read the advisory published by the PHP project or by the distribution you use. Compare the stated version range with the version installed in your environment. Rota Nacional does not fix PHP and does not replace applying updates. The platform acts on personal data in prompts and completions, applying markers, removal, or a block before any model runs. If you use AI to study the advisory, do not paste production code, credentials, keys, or customer data into prompts.
Original source: Re: CVE-2026-109619: RCE no PHP 8.2–8.5 por estado global obsoleto