Cyber ·
Two PHP 8.2 to 8.5 remote code execution CVEs caused by stale global state
A comment on the oss-sec list dated October 22, 2026 says CVE-2026-109618 and CVE-2026-109619 were found together but are two distinct vulnerabilities in PHP 8.2 to 8.5.
Radar records a comment published on October 22, 2026 on the oss-sec list by Emmanuel Fleury. Its title cites CVE-2026-109619 and describes remote code execution in PHP between versions 8.2 and 8.5, linked to stale global state. The text states that CVE-2026-109618 and CVE-2026-109619 were found together but appear to be two different vulnerabilities, although they share a lot. The comment is an automatic translation of content from the list feed and points to a technical description of the bugs and the discovery process, published by a researcher on their own site.
The excerpt received does not give details such as exploitation conditions, severity scores, the full list of affected versions, or an official fix. Check those in the original source. To consult and verify, open the October 2026 oss-sec archive, find the comment thread, and follow the technical link it cites. Then compare with the official PHP project advisory and with the bulletin from the distribution or vendor your organization uses.
Rota Nacional is not the solution to this problem, and this item does not describe any platform capability for fixing the PHP interpreter. The relevance for the reader is patch and inventory management: teams that maintain PHP applications should identify instances on the listed versions and prioritize the official update.
Original source: Re: CVE-2026-109619: RCE no PHP 8.2–8.5 por estado global obsoleto