Cyber ·
CVE-2026-109619: report of RCE in PHP 8.2 to 8.5 from stale global state
A May-style oss-sec discussion dated 22 October 2026 describes remote code execution in PHP 8.2 to 8.5 tied to stale global state. A comment claims the linked article covers versions back to 5.4, a claim not yet confirmed by the official advisory.
On 22 October 2026, the oss-sec mailing list published a reply with the subject CVE-2026-109619, which describes remote code execution (RCE) in PHP versions 8.2 to 8.5, associated with stale global state. The available text is a machine translation of a list feed, and its author is a participant in the discussion, not an official source of a fix.
According to the comment, a linked technical article documents that all versions since 5.4 are affected. That claim comes from a comment and is not confirmed in the material reproduced here. Intermediate versions and the actual extent of the impact should be checked in the official PHP project advisory and the CVE record. The content does not state a fixed version or mitigation steps.
Original source: Re: CVE-2026-109619: RCE no PHP 8.2–8.5 por estado global obsoleto