What is CVE-2026-109619 in simple terms?

It is a vulnerability in PHP where internal state tied to one request is not properly cleared or isolated. An attacker can take advantage of that stale state to run their own code on the server. No login or authentication is required, which is what makes it so serious.

Which PHP versions are affected by CVE-2026-109619?

The information available to us names PHP from the PHP Group as the affected product but does not list specific version numbers. Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-109619 and the vendor advisory linked there for the current affected-version list. Do not assume your build is unaffected until you have confirmed it against that list.

Is CVE-2026-109619 being actively exploited?

CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-26, which is the signal CISA uses for vulnerabilities with evidence of active exploitation. The federal remediation due date is 2026-10-29, an unusually short window. The catalog entry lists known ransomware use as "Unknown," which means the data is absent rather than negative.

What is the deadline to patch CVE-2026-109619?

Federal agencies have a due date of 2026-10-29, three days after the 2026-10-26 KEV addition. Private organizations are not bound by that date but should treat it as the practical target. Attackers do not wait for compliance deadlines.

What should I do if there is no patch available for my PHP setup?

The required action states that if mitigations are unavailable, you should discontinue use of the product. For cloud and managed PHP services, follow the applicable BOD 26-04 guidance for cloud services and confirm with your provider. Taking an exposed service offline is better than leaving an unauthenticated RCE reachable from the internet.

Does patching mean I am safe if the server was already attacked?

No. Patching closes the door but does not remove an attacker who already got in through it. Follow CISA's "Forensics Triage Requirements" referenced in the KEV notes before you reimage anything, then check for unexpected files, new scheduled jobs, and unusual outbound connections from your web servers.

CVE-2026-109619: PHP Vulnerability, What to Do Now

CVE-2026-109619 is a PHP vulnerability that allows unauthenticated remote code execution. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-26, with a federal remediation due date of 2026-10-29. If you run PHP anywhere that faces the internet, patch it now.

Here is what the official record actually says, and what it does not say. We will keep those two things separate.

What happened

The flaw is described as a stale internal request-state vulnerability in PHP. In plain terms, PHP holds internal state tied to a request, and that state is not correctly cleared or isolated between requests.

When an attacker can influence what is left behind, they can get the engine to act on data from the wrong request. The documented impact is unauthenticated remote code execution.

That combination is the worst case for a web runtime. No login needed, and code runs on your server with the privileges of the PHP process.

The authoritative entry is here: CVE-2026-109619 at NVD. Check that page for the current affected-version list and the vendor advisory link.

Who is affected

The advisory names the PHP Group's PHP as the affected product. It does not list specific version numbers in the information we have, so do not assume your build is safe.

PHP sits under a very large share of the web. That means the realistic exposure list is broad:

Public websites and web apps running PHP-FPM, mod_php, or FastCGI
CMS and e-commerce platforms built on PHP
Internal tools and admin panels that happen to be reachable from outside
Managed and cloud-hosted PHP runtimes, where your provider owns the patch
Container images and CI runners that bundle a PHP base image

Container images are the ones teams forget. A patched host does nothing for a stale `php:` image you rebuild from every week.

How serious is it

We will only state what the record supports. The documented impact is unauthenticated remote code execution, and the vulnerability is in CISA's KEV catalog.

KEV inclusion is the signal that matters. CISA adds entries there based on evidence of active exploitation, and the required action is to apply vendor mitigations.

On ransomware, the entry says "Known ransomware use: Unknown." That is not a clean bill of health. It means the data is not there, not that ransomware crews are ignoring it.

The NVD page is where to look for a CVSS score and the full technical write-up. We are not going to guess at a number that is not in front of us.

Is it being exploited

Treat it as yes. A vulnerability in the KEV catalog is one CISA has flagged for mandatory federal remediation, and the three-day window from 2026-10-26 to 2026-10-29 is unusually tight.

That short deadline is itself information. Agencies get longer windows for lower-risk items.

Exactly what to do now

Inventory your PHP. Find every host, container, and managed service running it. Include build agents and anything you forgot was still online.
Apply the vendor patch. Follow PHP's own upgrade instructions, not a blog's. Start from the vendor advisory linked on the NVD entry.
Prioritize by internet exposure. CISA's guidance puts the burden on you to evaluate each asset's exposure. Internet-facing PHP goes first, internal second.
Handle cloud and managed services separately. For hosted PHP, follow the applicable BOD 26-04 guidance for cloud services and confirm your provider has patched.
If no mitigation exists, stop using the product. That is the stated fallback in the required action. Pull it offline rather than leaving it exposed.
Run forensics triage before you wipe anything. Follow CISA's "Forensics Triage Requirements" referenced in the KEV notes. If a host was exploited, a rushed reimage destroys the evidence.
Then go look for signs of compromise. Unexpected PHP files, new cron jobs, outbound connections from web servers, modified templates. Patching does not evict someone already inside.

Step 6 is the one teams skip under deadline pressure. For an RCE that is already being exploited, assume breach until you have checked, and preserve the evidence first.

Federal agencies are bound by BOD 26-04 and its patching deadlines. Everyone else should borrow the timeline anyway, because attackers do not check whether you are in scope.

What IT and security learners can take from this

This CVE is a tidy lesson in three things that show up constantly in real work and on certification exams.

State isolation is a security control. A bug class like stale request state is not exotic. It is what happens when a long-lived process reuses memory across trust boundaries. The same pattern appears in connection pools, session caches, and shared worker threads.

Asset inventory is the real bottleneck. Most teams lose the patch race not because patching is hard, but because nobody knows where PHP is running. Inventory and exposure management are graded heavily on security certifications for exactly this reason.

Vulnerability management is a process, not a task. Read the advisory, judge exposure, patch, verify, then hunt. Skipping the last step is how an incident becomes a repeat incident.

If you want to build that skillset formally, our Cybersecurity certification vouchers cover vulnerability management, incident response, and triage fundamentals. The Penetration Testing & Ethical Hacking path is the other side of the same coin — it teaches you how an unauthenticated RCE actually gets chained in practice.

If your PHP lives in containers or managed cloud runtimes, patching is as much a pipeline problem as a server problem. The DevOps & Development and Linux & Server Administration categories cover the image rebuild and configuration management work that keeps a fix from quietly rolling back.

Vouchers from us arrive by email within 12 hours, and one voucher covers one exam attempt. If you are new to how this works, read How Exam Vouchers Work first.

The honest limits of this write-up

We do not have affected version numbers, a CVSS score, or exploit details for CVE-2026-109619. We are not going to fill those gaps with guesses.

Go to the NVD entry for the current technical record and the vendor advisory link. That page gets updated as the picture firms up; this article does not.

Sources

CVE-2026-109619 — NVD (National Vulnerability Database)