Description officielle (NVD)

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Preuves de concept publiques (12)

Dépôts tiers non vérifiés, parfois piégés. Ne les exécutez jamais en production : uniquement dans un environnement de test isolé.

unlimit0118/CVE-2026-109619-php2shell-poc · ★ 4 · 21/10/2026
Minimal PHP session upload progress use-after-free PoC and Docker lab.
cozybear-dev/cve-2026-109619 · ★ 3 · 21/10/2026
LordX404/php2shell-exploit · ★ 2 · 21/10/2026
this is a exploit for CVE-2026-109619
baimaobg/php-cve-2026-109619-lab · ★ 1 · 22/10/2026
santihabib/CVE-2026-109619 · ★ 0 · 21/10/2026
CVE-2026-109619: cross-request UAF in PHP session.upload_progress — reproduction, root-cause analysis and full chain to RCE
fmdiscioglu/php-cve-2026-109619-checker · ★ 0 · 21/10/2026
Non-destructive affected-version checker for CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) PHP UAF
1Nightlovel/CVE-2026-109619 · ★ 0 · 21/10/2026
php2shellscanner
syrex1013/CVE-2026-109619 · ★ 0 · 21/10/2026
basesixtythree/B63-POC-CVE-2026-109619 · ★ 0 · 21/10/2026
PoC and verification material for CVE-2026-109619 (PHP stale worker-global state)
VKKKV/php2shell-exp · ★ 0 · 22/10/2026
Profile-driven php2shell chain (CVE-2026-109619 class) for stock php:*-apache images; loopback lab only.

Les 10 dépôts les plus suivis sont affichés.

Références

https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp — Mitigation, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/21/16
http://www.openwall.com/lists/oss-security/2026/10/21/17
http://www.openwall.com/lists/oss-security/2026/10/21/23
http://www.openwall.com/lists/oss-security/2026/10/21/7
http://www.openwall.com/lists/oss-security/2026/10/22/2
https://www.wiz.io/blog/php2shell-php-rce — Third Party Advisory

En bref

Éditeur	php
Produit	php
Publiée le	21/10/2026
Modifiée le	22/10/2026
CVSS	9.2 (v4.0)
EPSS	5,76 % (centile 93)
CWE	CWE-416, CWE-755, CWE-824, CWE-1325

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS : probabilité estimée d'exploitation dans les 30 prochains jours.