CVE · Exploited · On CISA KEV

CVE-2026-109619

PHP Stale Internal Request-State Vulnerability

1: story
OCT 26: added to KEV

Vendor: PHP Group
Product: PHP
Added to KEV: Oct 26, 2026
KEV deadline: Oct 29, 2026
Ransomware use: Unknown

What it is

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

OCT 20
VulnerabilitiesCritical PHP Flaws Disclosed, Patches Out NowThe two flaws are CVE-2026-109618 and CVE-2026-109619 and are said to affect PHP versions 5, 6, 7, and 8.DENNIS FISHER · 3 MIN

Official references

3 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline