CVE-2026-109619

Name of the Vulnerable Software and Affected Versions PHP (affected versions not specified)

Description PHP maintains various global states, including error, session, object, and extension states, which temporarily point to memory owned by a specific request. A use after free occurs when this global state is not correctly reset or is repopulated after being reset, causing it to refer to request memory after it has been freed. Subsequent requests may read or branch based on this stale state before full initialization. This condition can be triggered through strategically crafted heap layouts to achieve remote code execution (RCE). Real-world exploitation of this issue has been recorded.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.