CVE-2026-109619

Описание

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is reset. If PHP catches the failure and continues cleanup, or reuses the persistent worker for a subsequent request, a later operation may act on the stale state after its underlying memory has been released. An unauthenticated attacker can exploit this to achieve use-after-free and remote code execution against mod_php. FPM is conditionally affected through application-stage paths.