Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PHP Group | PHP | 8.2.* – < 8.2.35, 8.3.* – < 8.3.36, 8.4.* – < 8.4.27, 8.5.* – < 8.5.12 | 8.2.35 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | php8.4 | 8.4.27-1 | — |
| Debian 13 | php8.4 | 8.4.27-1~deb13u1 | — |
| Debian 12 | php8.2 | 8.2.35-1~deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | php8.5 | 8.5.9-0ubuntu2.1 | USN-8948-1 |
| Ubuntu 26.04 LTS | php8.5 | 8.5.4-0ubuntu1.5 | USN-8948-1 |
| Ubuntu 24.04 LTS | php8.3 | 8.3.6-0ubuntu0.24.04.13 | USN-8948-1 |
| Ubuntu 22.04 LTS | php8.1 | 8.1.2-1ubuntu2.28 | USN-8948-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | php7.4 | 7.4.3-4ubuntu2.29+esm5 | USN-8948-2 |
| Ubuntu Pro 18.04 LTS | php7.2 | 7.2.24-0ubuntu0.18.04.17+esm14 | USN-8948-2 |
| Ubuntu Pro 16.04 LTS | php7.0 | 7.0.33-0ubuntu0.16.04.16+esm22 | USN-8948-2 |
| Ubuntu Pro 14.04 LTS | php5 | 5.5.9+dfsg-1ubuntu4.29+esm18 | USN-8948-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | php +23 | 8.3.36-1.el10_2 | RHSA-2026:87070 |
| RHEL 10 | php8.4 +23 | 8.4.27-1.el10_2 | RHSA-2026:98609, RHSA-2026:87071 |
| RHEL 9 | apcu-panel +2 | 5.1.23-1.module+el9.7.0+24111+199d2cc4 | RHSA-2026:97880, RHSA-2026:87079, RHSA-2026:87072 |
| RHEL 9 | php +23 | 8.0.30-8.el9_8.1 | RHSA-2026:97880, RHSA-2026:87151, RHSA-2026:87079 |
| RHEL 9 | php-pecl-redis6 | 6.1.0-3.module+el9.8.0+24343+756b4fcd | RHSA-2026:97880, RHSA-2026:87079 |
| RHEL 9 | php-pecl-rrd | 2.0.3-4.module+el9.7.0+24111+199d2cc4 | RHSA-2026:97880, RHSA-2026:87079, RHSA-2026:87072 |
| RHEL 9 | php-pecl-xdebug3 | 3.2.2-2.module+el9.7.0+24111+199d2cc4 | RHSA-2026:97880, RHSA-2026:87079, RHSA-2026:87072 |
| RHEL 9 | php-pecl-zip | 1.22.3-1.module+el9.7.0+24111+199d2cc4 | RHSA-2026:97880, RHSA-2026:87079, RHSA-2026:87072 |
| RHEL 8 | apcu-panel +2 | 5.1.18-1.module+el8.10.0+22485+a3539972 | RHSA-2026:87080, RHSA-2026:87073 |
| RHEL 8 | libzip +2 | 1.6.1-1.module+el8.10.0+22485+a3539972 | RHSA-2026:87080, RHSA-2026:87073 |
| RHEL 8 | php +25 | 7.4.33-8.module+el8.10.0+25117+30337cca | RHSA-2026:87080, RHSA-2026:87073 |
| RHEL 8 | php-pear | 1:1.10.13-1.module+el8.10.0+22485+a3539972 | RHSA-2026:87080, RHSA-2026:87073 |
| RHEL 8 | php-pecl-rrd | 2.0.1-1.module+el8.10.0+22485+a3539972 | RHSA-2026:87080, RHSA-2026:87073 |
| RHEL 8 | php-pecl-xdebug | 2.9.5-1.module+el8.10.0+22485+a3539972 | RHSA-2026:87080 |
| RHEL 8 | php-pecl-xdebug3 | 3.2.2-2.module+el8.10.0+20798+00eaeb41 | RHSA-2026:87073 |
| RHEL 8 | php-pecl-zip | 1.18.2-1.module+el8.10.0+22485+a3539972 | RHSA-2026:87080, RHSA-2026:87073 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | php +23 | 8.3.19-1.el10_0.2 | RHSA-2026:88561 |
| RHEL 9.6 EUS | apcu-panel +2 | 5.1.23-1.module+el9.4.0+20748+b46899d2 | RHSA-2026:89111, RHSA-2026:88834 |
| RHEL 9.6 EUS | php +23 | 8.0.30-3.el9_6.2 | RHSA-2026:89111, RHSA-2026:88834, RHSA-2026:88720 |
| RHEL 9.6 EUS | php-pecl-redis6 | 6.1.0-2.module+el9.6.0+22647+1741ae35 | RHSA-2026:89111 |
| RHEL 9.6 EUS | php-pecl-rrd | 2.0.3-4.module+el9.4.0+20748+b46899d2 | RHSA-2026:89111, RHSA-2026:88834 |
| RHEL 9.6 EUS | php-pecl-xdebug3 | 3.2.2-2.module+el9.4.0+20796+bd4564df | RHSA-2026:89111, RHSA-2026:88834 |
| RHEL 9.6 EUS | php-pecl-zip | 1.22.3-1.module+el9.4.0+20748+b46899d2 | RHSA-2026:89111, RHSA-2026:88834 |
| RHEL 9.4 E4S | apcu-panel +2 | 5.1.23-1.module+el9.4.0+20748+b46899d2 | RHSA-2026:88835 |
| RHEL 9.4 E4S | php +23 | 8.0.30-1.el9_4.2 | RHSA-2026:88835, RHSA-2026:88725 |
| RHEL 9.4 E4S | php-pecl-rrd | 2.0.3-4.module+el9.4.0+20748+b46899d2 | RHSA-2026:88835 |
| RHEL 9.4 E4S | php-pecl-xdebug3 | 3.2.2-2.module+el9.4.0+20796+bd4564df | RHSA-2026:88835 |
| RHEL 9.4 E4S | php-pecl-zip | 1.22.3-1.module+el9.4.0+20748+b46899d2 | RHSA-2026:88835 |
| RHEL 9.2 E4S | php +23 | 8.0.30-1.el9_2.2 | RHSA-2026:88659 |
| RHEL 8.8 TUS | apcu-panel +2 | 5.1.18-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88532 |
| RHEL 8.8 TUS | libzip +2 | 1.6.1-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88532 |
| RHEL 8.8 TUS | php +25 | 7.4.33-1.module+el8.8.0+25148+55cf9df9.2 | RHSA-2026:88532 |
| RHEL 8.8 TUS | php-pear | 1:1.10.13-1.module+el8.7.0+15127+a450a8db | RHSA-2026:88532 |
| RHEL 8.8 TUS | php-pecl-rrd | 2.0.1-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88532 |
| RHEL 8.8 TUS | php-pecl-xdebug | 2.9.5-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88532 |
| RHEL 8.8 TUS | php-pecl-zip | 1.18.2-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88532 |
| RHEL 8.8 E4S | apcu-panel +2 | 5.1.18-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88532 |
| RHEL 8.8 E4S | libzip +2 | 1.6.1-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88532 |
| RHEL 8.8 E4S | php +25 | 7.4.33-1.module+el8.8.0+25148+55cf9df9.2 | RHSA-2026:88532 |
| RHEL 8.8 E4S | php-pear | 1:1.10.13-1.module+el8.7.0+15127+a450a8db | RHSA-2026:88532 |
| RHEL 8.8 E4S | php-pecl-rrd | 2.0.1-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88532 |
| RHEL 8.8 E4S | php-pecl-xdebug | 2.9.5-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88532 |
| RHEL 8.8 E4S | php-pecl-zip | 1.18.2-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88532 |
| RHEL 8.6 EUS Long Life | apcu-panel +2 | 5.1.18-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88533 |
| RHEL 8.6 EUS Long Life | libzip +2 | 1.6.1-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88533 |
| RHEL 8.6 EUS Long Life | php +25 | 7.4.19-4.module+el8.6.0+25157+c2ff122e.3 | RHSA-2026:88533 |
| RHEL 8.6 EUS Long Life | php-pear | 1:1.10.13-1.module+el8.6.0+16577+0788886f | RHSA-2026:88533 |
| RHEL 8.6 EUS Long Life | php-pecl-rrd | 2.0.1-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88533 |
| RHEL 8.6 EUS Long Life | php-pecl-xdebug | 2.9.5-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88533 |
| RHEL 8.6 EUS Long Life | php-pecl-zip | 1.18.2-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88533 |
| RHEL 8.6 AUS | apcu-panel +2 | 5.1.18-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88533 |
| RHEL 8.6 AUS | libzip +2 | 1.6.1-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88533 |
| RHEL 8.6 AUS | php +25 | 7.4.19-4.module+el8.6.0+25157+c2ff122e.3 | RHSA-2026:88533 |
| RHEL 8.6 AUS | php-pear | 1:1.10.13-1.module+el8.6.0+16577+0788886f | RHSA-2026:88533 |
| RHEL 8.6 AUS | php-pecl-rrd | 2.0.1-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88533 |
| RHEL 8.6 AUS | php-pecl-xdebug | 2.9.5-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88533 |
| RHEL 8.6 AUS | php-pecl-zip | 1.18.2-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88533 |
| RHEL 8.4 EUS Long Life | apcu-panel +2 | 5.1.18-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88565 |
| RHEL 8.4 EUS Long Life | libzip +2 | 1.6.1-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88565 |
| RHEL 8.4 EUS Long Life | php +25 | 7.4.6-5.module+el8.4.0+25156+e0c98721.3 | RHSA-2026:88565 |
| RHEL 8.4 EUS Long Life | php-pear | 1:1.10.13-1.module+el8.4.0+16578+ed65e99e | RHSA-2026:88565 |
| RHEL 8.4 EUS Long Life | php-pecl-rrd | 2.0.1-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88565 |
| RHEL 8.4 EUS Long Life | php-pecl-xdebug | 2.9.5-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88565 |
| RHEL 8.4 EUS Long Life | php-pecl-zip | 1.18.2-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88565 |
| RHEL 8.4 AUS | apcu-panel +2 | 5.1.18-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88565 |
| RHEL 8.4 AUS | libzip +2 | 1.6.1-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88565 |
| RHEL 8.4 AUS | php +25 | 7.4.6-5.module+el8.4.0+25156+e0c98721.3 | RHSA-2026:88565 |
| RHEL 8.4 AUS | php-pear | 1:1.10.13-1.module+el8.4.0+16578+ed65e99e | RHSA-2026:88565 |
| RHEL 8.4 AUS | php-pecl-rrd | 2.0.1-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88565 |
| RHEL 8.4 AUS | php-pecl-xdebug | 2.9.5-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88565 |
| RHEL 8.4 AUS | php-pecl-zip | 1.18.2-1.module+el8.3.0+6678+b09f589e | RHSA-2026:88565 |
| RHEL 7 ELS | php +3 | 5.4.16-48.el7_9.1 | RHSA-2026:88693 |
| Red Hat Hardened Images 1 | php +26 | 8.5.12-1.hum1 | RHSA-2026:87414 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | php +23 | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux 10 | php8.4 +22 | 8.4.27-1.el10_2 | ALSA-2026:87071 |
| AlmaLinux 9 | apcu-panel +2 | 5.1.23-1.module_el9.4.0+65+49ff6472 | ALSA-2026:87079, ALSA-2026:87072 |
| AlmaLinux 9 | php +23 | 8.0.30-8.el9_8.1 | ALSA-2026:A014, ALSA-2026:87151, ALSA-2026:87079 |
| AlmaLinux 9 | php-pecl-redis6 | 6.1.0-3.module_el9.8.0+257+89d727f2 | ALSA-2026:87079 |
| AlmaLinux 9 | php-pecl-rrd | 2.0.3-4.module_el9.4.0+65+49ff6472 | ALSA-2026:87079, ALSA-2026:87072 |
| AlmaLinux 9 | php-pecl-xdebug3 | 3.2.2-2.module_el9.4.0+65+49ff6472 | ALSA-2026:87079, ALSA-2026:87072 |
| AlmaLinux 9 | php-pecl-zip | 1.22.3-1.module_el9.4.0+65+49ff6472 | ALSA-2026:87079, ALSA-2026:87072 |
| AlmaLinux 8 | apcu-panel +2 | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080, ALSA-2026:87073 |
| AlmaLinux 8 | libzip +1 | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080, ALSA-2026:87073 |
| AlmaLinux 8 | libzip-tools | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2026:87080, ALSA-2026:87073 |
| AlmaLinux 8 | php +25 | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A013, ALSA-2026:A012, ALSA-2026:A011 |
| AlmaLinux 8 | php-ffi | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:A013, ALSA-2026:87080, ALSA-2026:87073 |
| AlmaLinux 8 | php-pear | 1:1.10.13-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080, ALSA-2026:87073 |
| AlmaLinux 8 | php-pecl-rrd | 2.0.1-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080, ALSA-2026:87073 |
| AlmaLinux 8 | php-pecl-xdebug | 2.9.5-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080 |
| AlmaLinux 8 | php-pecl-xdebug3 | 3.2.2-2.module_el8.10.0+3796+30ed3ef7 | ALSA-2026:87073 |
| AlmaLinux 8 | php-pecl-zip | 1.18.2-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080, ALSA-2026:87073 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | php | 8.3.36-1.el10_2 | RLSA-2026:87070 |
| Rocky Linux 10 | php8.4 | 8.4.27-1.el10_2 | RLSA-2026:98609, RLSA-2026:87071 |
| Rocky Linux 10 | php8.4-gd +22 | 8.4.27-2.el10_3.1 | RLSA-2026:98609 |
| Rocky Linux 9 | apcu-panel +1 | 5.1.27-2.module+el9.9.0+40326+676d2670 | RLSA-2026:97880 |
| Rocky Linux 9 | php | 8.0.30-8.el9_8.1 | RLSA-2026:97880, RLSA-2026:87151, RLSA-2026:87079 |
| Rocky Linux 9 | php-gd +22 | 8.4.27-1.module+el9.9.0+40418+929a11b6 | RLSA-2026:97880 |
| Rocky Linux 9 | php-pecl-apcu | 5.1.23-1.module+el9.7.0+40004+bf50a568 | RLSA-2026:97880, RLSA-2026:87079, RLSA-2026:87072 |
| Rocky Linux 9 | php-pecl-redis6 | 6.1.0-3.module+el9.8.0+40203+35cc8ffc | RLSA-2026:97880, RLSA-2026:87079 |
| Rocky Linux 9 | php-pecl-rrd | 2.0.3-4.module+el9.7.0+40003+454ed3c4 | RLSA-2026:97880, RLSA-2026:87079, RLSA-2026:87072 |
| Rocky Linux 9 | php-pecl-xdebug3 | 3.2.2-2.module+el9.7.0+40004+bf50a568 | RLSA-2026:97880, RLSA-2026:87079, RLSA-2026:87072 |
| Rocky Linux 9 | php-pecl-zip | 1.22.3-1.module+el9.7.0+40004+bf50a568 | RLSA-2026:97880, RLSA-2026:87079, RLSA-2026:87072 |
| Rocky Linux 8 | libzip | 1.6.1-1.module+el8.10.0+1604+6558efc7 | RLSA-2026:87080, RLSA-2026:87073 |
| Rocky Linux 8 | php | 7.4.33-8.module+el8.10.0+40393+c071e357 | RLSA-2026:87080, RLSA-2026:87073 |
| Rocky Linux 8 | php-pear | 1:1.10.13-1.module+el8.10.0+1604+6558efc7 | RLSA-2026:87080, RLSA-2026:87073 |
| Rocky Linux 8 | php-pecl-apcu | 5.1.18-1.module+el8.10.0+1604+6558efc7 | RLSA-2026:87080, RLSA-2026:87073 |
| Rocky Linux 8 | php-pecl-rrd | 2.0.1-1.module+el8.4.0+414+2e7afcdd | RLSA-2026:87080, RLSA-2026:87073 |
| Rocky Linux 8 | php-pecl-xdebug | 2.9.5-1.module+el8.10.0+1604+6558efc7 | RLSA-2026:87080 |
| Rocky Linux 8 | php-pecl-xdebug3 | 3.2.2-2.module+el8.10.0+1596+477f03f8 | RLSA-2026:87073 |
| Rocky Linux 8 | php-pecl-zip | 1.18.2-1.module+el8.10.0+1604+6558efc7 | RLSA-2026:87080, RLSA-2026:87073 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | php7 +4 | 7.4.33-150400.4.81.1 | SUSE-SU-2026:4853-1 |
| SLES 15 SP7 | php7-test | 7.4.33-150400.4.81.2 | SUSE-SU-2026:4853-1 |
| SLES 15 SP7 | php8 +5 | 8.3.36-150700.3.24.1 | SUSE-SU-2026:4844-1 |
| SLES 15 SP6 | php7 +3 | 7.4.33-150400.4.81.1 | SUSE-SU-2026:4853-1 |
| SLES 15 SP6 | php8 +5 | 8.2.35-150600.3.39.1 | SUSE-SU-2026:4843-1 |
| SLES 15 SP5 | php7 +3 | 7.4.33-150400.4.81.1 | SUSE-SU-2026:4853-1 |
| SLES 15 SP5 | php8 +4 | 8.0.30-150400.4.80.1 | SUSE-SU-2026:4852-1 |
| SLES 15 SP5 | php8-test | 8.0.30-150400.4.80.2 | SUSE-SU-2026:4852-1 |
| SLES 15 SP4 | php7 +3 | 7.4.33-150400.4.81.1 | SUSE-SU-2026:4853-1 |
| SLES 15 SP4 | php8 +4 | 8.0.30-150400.4.80.1 | SUSE-SU-2026:4852-1 |
| SLES 15 SP4 | php8-test | 8.0.30-150400.4.80.2 | SUSE-SU-2026:4852-1 |
| SLES 12 | php74 | 7.4.33-1.74.1 | SUSE-SU-2026:4870-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | php8 +4 | 8.4.27-160000.1.1 | SUSE-SU-2026:24271-1 |
| SLES for SAP 15 SP6 | php7 +3 | 7.4.33-150400.4.81.1 | SUSE-SU-2026:4853-1 |
| SLES for SAP 15 SP6 | php8 +5 | 8.2.35-150600.3.39.1 | SUSE-SU-2026:4843-1 |
| SLES for SAP 15 SP5 | php7 +3 | 7.4.33-150400.4.81.1 | SUSE-SU-2026:4853-1 |
| SLES for SAP 15 SP5 | php8 +4 | 8.0.30-150400.4.80.1 | SUSE-SU-2026:4852-1 |
| SLES for SAP 15 SP5 | php8-test | 8.0.30-150400.4.80.2 | SUSE-SU-2026:4852-1 |
| SLES for SAP 15 SP4 | php7 +3 | 7.4.33-150400.4.81.1 | SUSE-SU-2026:4853-1 |
| SLES for SAP 15 SP4 | php8 +4 | 8.0.30-150400.4.80.1 | SUSE-SU-2026:4852-1 |
| SLES for SAP 15 SP4 | php8-test | 8.0.30-150400.4.80.2 | SUSE-SU-2026:4852-1 |
| SLES 16.0 | php8 +4 | 8.4.27-160000.1.1 | SUSE-SU-2026:24271-1 |
| SLE HPC 15 SP5 | php8 +4 | 8.0.30-150400.4.80.1 | SUSE-SU-2026:4852-1 |
| SLE HPC 15 SP5 | php8-test | 8.0.30-150400.4.80.2 | SUSE-SU-2026:4852-1 |
| SLE HPC 15 SP4 | php7 +3 | 7.4.33-150400.4.81.1 | SUSE-SU-2026:4853-1 |
| SLE HPC 15 SP4 | php8 +4 | 8.0.30-150400.4.80.1 | SUSE-SU-2026:4852-1 |
| SLE HPC 15 SP4 | php8-test | 8.0.30-150400.4.80.2 | SUSE-SU-2026:4852-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php8 | 8.5.12-1.1 | openSUSE-SU-2026:12219-1 |
| openSUSE Leap 16.0 | php8 +5 | 8.4.27-160000.1.1 | openSUSE-SU-2026:22151-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | php83 | 8.3.36-r0 | — |
| Alpine v3.24 | php84 | 8.4.27-r0 | — |
| Alpine v3.24 | php85 | 8.5.12-r0 | — |
| Alpine v3.23 | php83 | 8.3.36-r0 | — |
| Alpine v3.23 | php84 | 8.4.27-r0 | — |
| Alpine v3.23 | php85 | 8.5.12-r0 | — |
| Alpine v3.22 | php82 | 8.2.35-r0 | — |
| Alpine v3.22 | php83 | 8.3.36-r0 | — |
| Alpine v3.22 | php84 | 8.4.27-r0 | — |
| Alpine v3.21 | php82 | 8.2.35-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | php8.2 +27 | 8.2.35-1.amzn2023.0.1 | ALAS2023-2026-3301 |
| Amazon Linux 2023 | php8.3 +28 | 8.3.36-1.amzn2023.0.1 | ALAS2023-2026-3302 |
| Amazon Linux 2023 | php8.4 +27 | 8.4.27-1.amzn2023.0.1 | ALAS2023-2026-3303 |
| Amazon Linux 2023 | php8.5 +26 | 8.5.12-1.amzn2023.0.1 | ALAS2023-2026-3304 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | php +1 | 8.3.35-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | php +23 | 8.3.36-1.el10_2 | ELSA-2026-87070 |
| Oracle Linux 10 | php8.4 +23 | 8.4.27-1.el10_2 | ELSA-2026-87071 |
| Oracle Linux 9 | apcu-panel +2 | 5.1.23-1.module+el9.4.0+90261+af5cc950 | ELSA-2026-87079, ELSA-2026-87072 |
| Oracle Linux 9 | php +23 | 8.0.30-8.el9_8.1 | ELSA-2026-87151, ELSA-2026-87079, ELSA-2026-87072 |
| Oracle Linux 9 | php-pecl-redis6 | 6.1.0-3.module+el9.8.0+90982+92b8b4c7 | ELSA-2026-87079 |
| Oracle Linux 9 | php-pecl-rrd | 2.0.3-4.module+el9.4.0+90261+af5cc950 | ELSA-2026-87079, ELSA-2026-87072 |
| Oracle Linux 9 | php-pecl-xdebug3 | 3.2.2-2.module+el9.4.0+90261+af5cc950 | ELSA-2026-87079, ELSA-2026-87072 |
| Oracle Linux 9 | php-pecl-zip | 1.22.3-1.module+el9.4.0+90261+af5cc950 | ELSA-2026-87079, ELSA-2026-87072 |
| Oracle Linux 8 | apcu-panel +2 | 5.1.18-1.module+el8.10.0+90472+f810484b | ELSA-2026-87080, ELSA-2026-87073 |
| Oracle Linux 8 | libzip +2 | 1.6.1-1.module+el8.10.0+90472+f810484b | ELSA-2026-87080, ELSA-2026-87073 |
| Oracle Linux 8 | php +25 | 7.4.33-8.module+el8.10.0+91080+9785160d | ELSA-2026-87080, ELSA-2026-87073 |
| Oracle Linux 8 | php-pear | 1:1.10.13-1.module+el8.10.0+90472+f810484b | ELSA-2026-87080, ELSA-2026-87073 |
| Oracle Linux 8 | php-pecl-rrd | 2.0.1-1.module+el8.10.0+90472+f810484b | ELSA-2026-87080, ELSA-2026-87073 |
| Oracle Linux 8 | php-pecl-xdebug | 2.9.5-1.module+el8.10.0+90472+f810484b | ELSA-2026-87080 |
| Oracle Linux 8 | php-pecl-xdebug3 | 3.2.2-2.module+el8.10.0+90469+8883f508 | ELSA-2026-87073 |
| Oracle Linux 8 | php-pecl-zip | 1.18.2-1.module+el8.10.0+90472+f810484b | ELSA-2026-87080, ELSA-2026-87073 |
| Oracle Linux 7 | php +24 | 5.4.16-48.0.1.el7 | ELSA-2026-88693 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | php-8.2 | 8.2.34-r4 | — |
| Wolfi rolling | php-8.3 | 8.3.35-r4 | — |
| Wolfi rolling | php-8.4 | 8.4.26-r4 | — |
| Wolfi rolling | php-8.5 | 8.5.11-r4 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 30 repositories · most starred shown
-
aarsaputra/php2shell ★ 146 · Oct 23, 2026
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
-
unlimit0118/CVE-2026-109619-php2shell-poc ★ 6 · Oct 21, 2026
Minimal PHP session upload progress use-after-free PoC and Docker lab.
-
cozybear-dev/cve-2026-109619 ★ 4 · Oct 21, 2026
-
dev-maple/php2shell-CVE-2026-109619 ★ 2 · Oct 26, 2026
CVE-2026-109619 (PHP2Shell): Pre-Auth Remote Code Execution (RCE) via PHP-FPM Stale Global State Deserialization UAF. Reproducible Docker lab, interactive shell, reverse shell & WAF/IDS rules.
-
EQSTLab/CVE-2026-109619 ★ 2 · Oct 23, 2026
PHP2Shell
-
LordX404/php2shell-exploit ★ 2 · Oct 21, 2026
this is a exploit for CVE-2026-109619
-
DarynOngera/solid-palm-tree ★ 1 · Oct 23, 2026
CVE-2026-109619 / CVE-2026-109618 PoC
-
mazdel/php2shell-poc ★ 1 · Oct 22, 2026
Zero-dependency Python PoC & Docker Compose reproduction for CVE-2026-109619 via PHP RFC1867 upload progress and opcache.preload. (133 characters)
-
baimaobg/php-cve-2026-109619-lab ★ 1 · Oct 22, 2026
-
infiniroot/ansible-mitigate-php2shell ★ 1 · Oct 21, 2026
Ansible Playbook that runs through your PHP-FPM and OpenLiteSpeed PHP files and applies a mitigation against CVE-2026-109619.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 - Use-After-Free Remote Code Execution http/cves/2026/CVE-2026-109619.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 50
- RHSA-2026:87079 Red Hat Security Advisory: php:8.3 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:87070 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98609 Red Hat Security Advisory: php8.4 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:97880 Red Hat Security Advisory: php:8.4 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:87072 Red Hat Security Advisory: php:8.2 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:87073 Red Hat Security Advisory: php:8.2 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:87080 Red Hat Security Advisory: php:7.4 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:87151 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:87071 Red Hat Security Advisory: php8.4 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88693 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88835 Red Hat Security Advisory: php:8.2 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88565 Red Hat Security Advisory: php:7.4 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:89111 Red Hat Security Advisory: php:8.3 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88533 Red Hat Security Advisory: php:7.4 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88720 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88532 Red Hat Security Advisory: php:7.4 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88725 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:87414 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88659 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88561 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88834 Red Hat Security Advisory: php:8.2 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:98609 Important: php8.4 security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97880 Important: php:8.4 security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-4055 PHP: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Nov 12, 2026
- ICSA-26-316-01 Siemens Building Automation and Energy Products CISA ICS & IT advisories · Nov 12, 2026
- ICSA-26-316-05 Siemens RUGGEDCOM APE1808 CISA ICS & IT advisories · Nov 12, 2026
- 3KXG141033R4801 ACF5000 LCS/CCUS PHP2Shell and OpenSSL Vulnerabilities ABB PSIRT · Nov 12, 2026
- VDE-2026-160 Helmholz: php2shell in myREX24V2/myREX24V2.virtual CERT@VDE · Nov 10, 2026
- VDE-2026-128 MB connect line: php2shell in mbCONNECT24/mymbCONNECT24 CERT@VDE · Nov 10, 2026
- 4TLB000837 IPEC Standalone iSM PHP2Shell and NTFS-3G Vulnerabilities ABB PSIRT · Nov 6, 2026
- 2NGA003256 Netcontrol 100, 200, 500, GW502-iM, NAM PHP2Shell Critical Vulnerabilities ABB PSIRT · Nov 6, 2026
- FSA-202603 Two critical PHP vulnerabilities in several Festo Didactic products CERT@VDE · Nov 5, 2026
- SSA-166980 SSA-166980: PHP2Shell Vulnerabilities in Siemens Products Siemens ProductCERT · Nov 5, 2026
- VDE-2026-132 WAGO: Multiple Devices affected by PHP2Shell CERT@VDE · Nov 4, 2026
- SSA-566435 SSA-566435: PHP2Shell Vulnerabilities in Siemens Software Products Siemens ProductCERT · Nov 4, 2026
- SSA-566512 SSA-566512: PHP2Shell Vulnerabilities in Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Nov 4, 2026
- SA26P015 APROL Impact of PHP2Shell ABB PSIRT · Nov 3, 2026
- 2NGA003224 PHP2Shell Critical Vulnerabilities ABB PSIRT · Oct 30, 2026
- ALSA-2026:87151 Important: php security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:87072 Important: php:8.2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:87079 Important: php:8.3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:A014 Important: php:8.1 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:87071 Important: php8.4 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:87070 Important: php security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:A011 Important: php:7.2 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:A012 Important: php:7.3 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:A013 Important: php:8.0 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:87080 Important: php:7.4 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:87073 Important: php:8.2 security update AlmaLinux Security Advisories · Oct 29, 2026
- VDE-2026-127 Welotec: PHP2Shell Vulnerabilities in SMART EMS CERT@VDE · Oct 29, 2026