CVE-2026-109619 — PHP2Shell stale global state

The second path of PHP2Shell, rated CVSS v4.0 9.2 Critical and fixed in the same 21 October 2026 release.

Enter your domain

Free. No sign-up, no email. Public response headers only.

What it is

CVE-2026-109619 is the second path of PHP2Shell. The PHP project attributes it to global state that is not reset between requests, so data left behind by one request can influence how a later request executes. Like the memory corruption flaw it is remotely reachable through normal web request handling and rated CVSS v4.0 9.2, Critical.

Affected and fixed releases

Branch	Fixed in	Notes
8.6	8.6.0 RC4	RC1 to RC3 are affected
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36	Recommended upgrade target from 8.1 and older
8.2	8.2.35	Branch reaches end of life on 31 December 2026
8.1 and older	none	No official fix; some distributions ship backported builds

Why it matters for ordinary sites

A flaw that depends on request state rather than on a specific function is not limited to one framework or one popular plugin. Any PHP that handles web requests should be treated as in scope, and long-lived worker processes deserve particular attention because state is more likely to survive across requests.

Fix checklist

Run php -v to find your branch and patch level.
Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Verify the SAPI in use matches the version you upgraded.
Restart workers and web server, then re-check.

Disabling session.upload_progress helps against one of the two PHP2Shell flaws only. See the overview page for what that mitigation does and does not cover.

Frequently asked

Was this patched separately from CVE-2026-109618?

No. One release, on 21 October 2026, fixed both.

Is PHP 8.1 affected?

Yes, and it receives no official fix. Upgrade to a supported branch.