CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-10-21
PHP Remote Code Execution (RCE) via Global State Use-After-Free (CVE-2026-109619)
[Affected Scope] PHP 8.1, 8.2, and 8.3 environments without the latest security patches.
[Impact] Remote attackers can achieve arbitrary code execution (RCE) by exploiting memory corruption in the PHP global state.
[Mitigation] Immediately update PHP to the latest security release and restart PHP-FPM/Web server processes.