Cyber ·
CVE-2026-109619: RCE in PHP 8.2 to 8.5 via stale global state
An oss-sec mailing list post dated October 21, 2026 describes remote code execution (RCE) in PHP caused by stale global state. The fixed versions listed are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. A reply warns that the title may suggest that earlier versions are not affected.
What the record states: the vulnerability is identified as CVE-2026-109619 and is described as remote code execution in PHP caused by stale global state. According to the quoted text from Jakub Zelenka, the affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27 and PHP 8.5 before 8.5.12. The message was posted by Christian Fischer on October 21, 2026, as a reply on the oss-sec list, and is an automatic translation of the feed content.
Point of attention: the reply notes that the title and text may wrongly suggest that only versions 8.2 to 8.5 are affected and that earlier versions are out of scope. The cited material neither confirms nor rules out the situation for earlier versions. Do not treat the absence of a mention as a security guarantee.
How to consult and verify: use the 2026 PHP security archive entry and the oss-sec list post referenced in the source, searching by the CVE identifier. Compare the exact version in use with the listed ranges and confirm in the official advisory whether other versions are affected.
Original source: Re: CVE-2026-109619: RCE no PHP 8.2–8.5 por estado global obsoleto