EUVD-2026-107265Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend request to persistent PHP worker
-
DeliveryPublish request-owned global state
-
ExploitTrigger fatal error abandoning state reset
-
ExecutionGroom heap on subsequent same-worker request
-
PersistEarly operation consumes stale pointer (use-after-free)
-
ImpactExecute arbitrary code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a persistent PHP worker that reuses memory across requests, so that request-owned global state outlives the request heap. Concretely the advisory requires: (1) a producer operation that publishes request-owned state (error, session, object or extension state); (2) an interruption - a fatal error such as parse/compile failure, uncaught error, failed require, 'Maximum execution time exceeded', or OOM, or a nonfatal diagnostic during later shutdown - that prevents the matching reset; (3) the request heap being freed while the worker's global still references it; and (4) a later request to the same worker whose early operation (an INI diagnostic warning raised when applying invalid/deprecated settings before executor initialization, or session upload progress handling) consumes the stale state before normal initialization. Confirmed paths: PHP 8.5 with fatal_error_backtraces enabled (the basis of the confirmed mod_php RCE), and the session upload progress lifecycle (enabled by default, no session_start() needed). Reachability is strongest with Apache mod_php, where .htaccess / php_value / php_admin_* directives are applied before php_request_startup(); FPM is only conditionally exposed when a frontend (nginx, mod_proxy_fcgi) passes PHP_VALUE/PHP_ADMIN_VALUE producing an early diagnostic, and FPM kills a child on startup failure, so the FPM path instead relies on state published during application execution plus session upload progress as the consumer. Limiting factors: high attack complexity and heap grooming (AC:H/AT:P), the need for the same worker to handle a subsequent request, and the fact that error_reporting, @, display_errors or log_errors settings do NOT protect against it. FrankenPHP's default configuration did not establish an equivalent early consumer, though it is not stated to be immune. Note that error_reporting, @, disabling display_errors or log_errors do not mitigate this, and the vendor states updating is the only reliable fix. |
| Impact | The headline is a CVSS 4.0 base score of 9.2 (AV:N/AC:H/AT:P/PR:N/UI:N with VC:H/VI:H/VA:H), reflecting unauthenticated network-reachable code execution against PHP, one of the most widely deployed web runtimes. Several signals pull in different directions and should be weighed together. The SSVC framework reports Exploitation: none and Automatable: no, with Technical Impact: total - meaning catastrophic impact if achieved, but no evidence of automated or active exploitation. This is consistent with the CVSS AC:H and AT:P metrics: the advisory describes exploitation requiring a strategically crafted heap layout plus a producer/consumer sequence spanning two requests handled by the same persistent worker, so it is not a point-and-click bug. No EPSS score and no CISA KEV listing were supplied, so widespread or confirmed in-the-wild exploitation cannot be asserted; absence of EPSS limits probabilistic comparison. Against that, the vuln.today Decision label is act_now and a vendor patch is available across all supported branches, and the PHP GHSA confirms a demonstrated RCE case (mod_php with fatal_error_backtraces). Net assessment: this is a genuine high priority driven by product ubiquity, total technical impact, a working vendor-demonstrated exploitation path, and availability of a fix - not merely a high-CVSS-but-low-real-risk issue - but the high attack complexity and lack of KEV/EPSS data suggest skilled, likely targeted exploitation rather than immediate commodity mass exploitation. The act_now label should be followed given PHP's footprint and the total impact. |
| Exploit ScenarioDerived | A remote attacker repeatedly interacts with a PHP application served by a persistent worker (e.g. Apache mod_php), first driving an operation that publishes request-owned global state and then triggering a fatal error (such as memory exhaustion or an uncaught error) that abandons the normal state reset, leaving a dangling pointer into freed request heap. On a subsequent request handled by the same worker, an early operation - an INI diagnostic warning or session upload progress handling that runs before normal request initialization - consumes that stale state, and with a carefully groomed heap this use-after-free is leveraged into arbitrary code execution. A public PoC reference exists but is not verified as working exploit code; the demonstrated mod_php case with fatal_error_backtraces is the strongest confirmed path, and the high attack complexity (AC:H/AT:P) reflects the heap grooming and cross-request timing required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Oct 22, 2026
Use-after-free in PHP's per-request global state handling lets unauthenticated remote attackers achieve arbitrary code execution against persistent workers that reuse memory across requests - PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12 are affected. Exploitation is high complexity (CVSS:4.0 9.2 with AC:H/AT:P): it needs a 'producer' operation that leaves request-owned state published after an interruption such as a fatal error, uncaught exception, timeout or OOM, followed by a later request to the same worker whose early operation consumes the stale pointer before normal initialization resets it. The vendor documents a confirmed mod_php RCE path (PHP 8.5 with fatal_error_backtraces enabled) and a confirmed session upload progress lifecycle; a public PoC reference exists but is not verified as working exploit code, CISA SSVC records exploitation as none, and the priority decision is act_now because affected PHP branches are patched and technical impact is total.
Earlier versions of this analysis (4)
Remote code execution in PHP 8.2 through 8.5 stems from use-after-free of worker-global state that survives a request boundary, allowing an unauthenticated remote attacker who can shape the heap to execute code in a persistent worker process. Affected are PHP before 8.2.35, 8.3.36, 8.4.27 and 8.5.12; vendor fixes exist for every branch and the priority decision is act_now. No active exploitation is confirmed (no CISA KEV entry, SSVC exploitation: none), but a public PoC reference exists and it is not verified as working exploit code.
Remote code execution in PHP 8.2, 8.3, 8.4 and 8.5 arises when a persistent worker keeps request-owned global state (error, session, object or extension state) that still points into a request heap that has already been freed, and a later request consumes that stale pointer before normal request initialization can reset it. The flaw is rated CVSS 9.2 and vuln.today labels it act_now; exploitation is unauthenticated but high complexity, because it requires a producer operation to publish state, an interruption (fatal error, failed require, execution timeout or OOM) that abandons the matching reset, a second request handled by the same worker, and a consumer that runs early - plus a strategically crafted heap layout to turn the use-after-free into code execution. A public PoC reference exists; whether it achieves the full impact is unverified, CISA SSVC records Exploitation: none, and vendor-supplied fixes are available in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Remote code execution in PHP can occur when a network-reachable application or service exercises a use-after-free code path in the PHP runtime (CWE-416); successful exploitation could allow an unauthenticated remote attacker to corrupt memory and potentially execute code. PHP deployments running vulnerable versions are affected, but exploitation is constrained by high attack complexity and attack requirements, including the need to invoke the specific vulnerable code path and achieve a precise memory or timing condition. No public exploit identified at time of analysis, and a vendor patch is available per the referenced advisories.
Remote code execution is reported in software distributed through Ubuntu, per a CVE attributed to the Ubuntu security team as reporting vendor. The record supplies no product feature, package name, version range, CWE class, or CVSS vector, so the affected component, the attack surface, and whether exploitation requires authentication, user interaction, or network reachability remain unconfirmed from the available data alone. No public exploit code was identified at time of analysis, and no EPSS score or CISA KEV entry accompanies this record, so active exploitation is neither confirmed nor ruled out. Risk cannot be meaningfully quantified from the provided data; defenders should treat the CVE as an unprioritised RCE lead pending the corresponding Ubuntu security notice.
RemediationAI
Vendor-released patches are available: update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 as appropriate for your branch, per GHSA-6wmf-4rv5-p3rp (https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp), and apply the corresponding distribution update - Ubuntu users should follow USN-8948-1 (https://ubuntu.com/security/notices/USN-8948-1). The vendor states explicitly that updating to a release containing the complete state reset patch is the only reliable mitigation, because there is no complete generic configuration fix: an application, extension or server path may publish or consume stale state without a predictable log entry. If a patch cannot be applied immediately, two administrative workarounds remove specific demonstrated paths and require restarting every worker: on PHP 8.5 set fatal_error_backtraces=0 to remove the producer used in the confirmed mod_php RCE case (side effect: no backtraces in fatal error reports, and other request-owned global/extension state remains exposed), and set session.upload_progress.enabled=0 to block the demonstrated early session producing and consuming operations (side effect: PHP's upload progress reporting disappears for applications that rely on it; the vendor notes this feature is hardly used and suggests leaving it disabled even after patching). Additionally reduce the remaining lifecycle links by eliminating fatal errors on attacker-reachable paths - including upload, import, error page, shutdown, destructor, serialization, output handler, plugin and extension flows, and callbacks that can raise a fatal error while an operation holds temporary state - and by eliminating warnings or other diagnostics emitted during extension post-deactivation and server cleanup after request error state has been cleared. Note that error_reporting, the @ operator, display_errors and log_errors do not mitigate this issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (use after free) in PHP's worker lifecycle, which the upstream advisory frames as 'RCE via stale global state' (also tagged CWE-755, CWE-824, CWE-1325, CWE-1419). PHP keeps global state - error, session, object and extension state - that persists for a worker but points into memory owned by a single request; that state must be reset before the request heap is freed. A fatal error (parse/compile failure, uncaught error, failed require, 'Maximum execution time exceeded', memory exhaustion) can abandon an operation before it performs its matching reset, or a nonfatal diagnostic during extension/server cleanup can repopulate error state after the normal reset, so the heap is freed while the worker's global still references it. A subsequent request to the same worker then hits the dangling reference in an operation that runs before normal request initialization. Confirmed consumers are (1) INI diagnostics raised while applying invalid or deprecated settings before executor initialization - for example auto_detect_line_endings, non-default filter.default, legacy assert.* and session settings, mbstring/iconv encoding directives, and malformed memory_limit or body-size values - and (2) session upload progress handling, which reaches session/decoder state before ordinary session initialization and needs no session_start() call. Because global state is touched before PHP decides whether to report, display or log, error_reporting, the @ operator, display_errors and log_errors provide no protection. Reachability differs by SAPI: mod_php applies .htaccess and php_value/php_admin_* directory configuration before php_request_startup(), which is why the confirmed exploitation case is mod_php; FPM is only conditionally exposed (a frontend passing PHP_VALUE/PHP_ADMIN_VALUE that triggers an early diagnostic) and terminates a child on startup failure, so its validated path publishes state during application execution and uses session upload progress as the early consumer; LSAPI is a conditional candidate via early environment INI values, and an equivalent early consumer was not established in FrankenPHP's default configuration, which does not establish immunity. A strategically crafted heap layout converts the dangling reference into full remote code execution, which is why the severity is high despite the strict preconditions.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but AC:H because exploitation needs cross-request timing on a shared worker and a crafted heap layout; RCE yields C/I/A:H.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
6DescriptionCVE.org
Remote code execution issue
Articles & Coverage 2
Technical POC Analysis
CWE-416 Use After Free in the PHP runtime (php-src).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
CVE-2026-109619 is a critical use-after-free vulnerability in PHP that could allow unauthenticated remote attackers to execute arbitrary code on web servers using persistent worker processes. This puts any organization running affected PHP versions at risk of full server compromise, potentially leading to data breaches, service disruption, and reputational damage. Leadership should prioritize immediate patching because the vulnerability is remotely exploitable and affects widely deployed PHP branches.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB