9.2
Critical
Exploited
PHP2Shell
CVE-2026-109619 RCE via stale global state
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware campaigns
Not observed so far
Weakness
CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- None
- Interaction
- None
- Confidentiality
- High
- Integrity
- High
- Availability
- High
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP 8.5 | earliest → < 8.5.12 | 8.5.12 |
| PHP 8.4 | earliest → < 8.4.27 | 8.4.27 |
| PHP 8.3 | earliest → < 8.3.36 | 8.3.36 |
| PHP 8.2 | earliest → < 8.2.35 | 8.2.35 |
| RUGGEDCOM APE1808 | Versions not published | |
| AX4 | Versions not published | |
| CADRA | Versions not published | |
| Capital | Versions not published | |
| Designcenter | Versions not published |
Show the 102 other branches Hide the 102 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Designcenter X | Versions not published | |
| DFMExpress | Versions not published | |
| HyperLynx | Versions not published | |
| Insights Hub | Versions not published | |
| Opcenter Connect Electronics | Versions not published | |
| Opcenter Connect MOM | Versions not published | |
| Opcenter Execution Core | Versions not published | |
| Opcenter Execution Foundation | Versions not published | |
| Opcenter Execution Pharma | Versions not published | |
| Opcenter Intelligence | Versions not published | |
| Opcenter Intra Plant Logistics | Versions not published | |
| Opcenter Quality | Versions not published | |
| Opcenter RDnL | Versions not published | |
| Opcenter X | Versions not published | |
| PADS Pro Essentials | Versions not published | |
| PADS Pro Student Edition | Versions not published | |
| PADS Professional | Versions not published | |
| PADS Professional - XCR | Versions not published | |
| PADS Standard - XCR | Versions not published | |
| PADS Standard & Standard Plus | Versions not published | |
| Polarion | Versions not published | |
| QuadView | Versions not published | |
| Simcenter Flomaster | Versions not published | |
| Simcenter Flux | Versions not published | |
| Simcenter Simlab | Versions not published | |
| Solid Edge | Versions not published | |
| Supply Chain Suite | Versions not published | |
| Teamcenter | Versions not published | |
| Teamcenter Product Cost Management | Versions not published | |
| Teamcenter Visualization | Versions not published | |
| Tecnomatix Plant Simulation | Versions not published | |
| TestWay | Versions not published | |
| Valor NPI | Versions not published | |
| Xcargo | Versions not published | |
| Xpedition Designer | Versions not published | |
| Xpedition Enterprise | Versions not published | |
| Xpedition Enterprise XCR | Versions not published | |
| Xpedition IC Packaging | Versions not published | |
| Xpedition Layout Browser | Versions not published | |
| AMIS TS | Versions not published | |
| blueplanet 360 NX3 M6 WM OD IISX | Versions not published | |
| blueplanet 360 NX3 M6 WM OD IISX - S | Versions not published | |
| Energy Engage V2.0SP9 | Versions not published | |
| Energy Engage V3.1SP1 | Versions not published | |
| Spectrum Power 3 | Versions not published | |
| Spectrum Power 4 | Versions not published | |
| Spectrum Power 7 | Versions not published | |
| Spectrum Power TG | Versions not published | |
| Designcenter X Essentials | Versions not published | |
| Opcenter Execution Discrete | Versions not published | |
| Opcenter Execution Process | Versions not published | |
| Pathway to Learning Engineering | Versions not published | |
| Teamcenter Share | Versions not published | |
| Building X | Versions not published | |
| Call stations | Versions not published | |
| Chargesight | Versions not published | |
| Climatix Cloud IC | Versions not published | |
| Climatix Devices | Versions not published | |
| Connect Insights | Versions not published | |
| Connect X200 | Versions not published | |
| Connect X300 | Versions not published | |
| Connect X500 | Versions not published | |
| cRSP | Versions not published | |
| Depotfinity | Versions not published | |
| Desigo CC | Versions not published | |
| Desigo DXR2 | Versions not published | |
| Desigo DXR3 | Versions not published | |
| Desigo Optic | Versions not published | |
| Desigo PXC3 | Versions not published | |
| Desigo PXC4 | Versions not published | |
| Desigo PXC5 | Versions not published | |
| Desigo PXC7 | Versions not published | |
| Energy Management System | Versions not published | |
| Enlighted RTLS | Versions not published | |
| Enlighted Space | Versions not published | |
| Heliox Flex Pro | Versions not published | |
| Heliox H60 | Versions not published | |
| Heliox Rapid | Versions not published | |
| Local Monitoring bt-monitoring-vm 20261103 | earliest → < 20261103 | 20261103 |
| Navigator E&S | Versions not published | |
| Novigo VANSYS | Versions not published | |
| Novigo VANSYS core | Versions not published | |
| PACE-Design | Versions not published | |
| Sicharge D | Versions not published | |
| Sicharge D Configuration Backend | Versions not published | |
| SICHARGE FLEX | Versions not published | |
| SICHARGE UC | Versions not published | |
| Sifinity Control | Versions not published | |
| Sifinity Go | Versions not published | |
| Sifinity Setup | Versions not published | |
| Sinteso FS20 EN | Versions not published | |
| SiPass integrated | Versions not published | |
| SIPORT | Versions not published | |
| Siveillance Control | Versions not published | |
| Siveillance Control Pro | Versions not published | |
| Siveillance Intrusion | Versions not published | |
| Siveillance Video | Versions not published | |
| Verischarge | Versions not published | |
| VersiCloudHeliox Dual Port 60kW | Versions not published | |
| Voice alarm panels | Versions not published | |
| Voice alarm systems and audio matrices | Versions not published | |
| Workplace Experience | Versions not published |
References
- github.com github.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of PHP
The 103 CVEs of PHP →
CVE-2026-109618
RCE via OOM corruption
9.2
Critical
CVE-2026-92842
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a…
5.9
Medium
CVE-2026-91768
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so…
6.5
Medium
CVE-2026-91769
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry…
4.3
Medium