Vigilbase CVEConnect your agent

PHP Stale Internal Request-State Vulnerability

Exploited · KEV 2026-10-26Public exploit codeTrending #6CVE-2026-109619CWE-416CWE-755

Exploited since 2026-10-26. 4 of 8 rule sources name it; Cloudflare blocks by default. 1 public exploit repo.

Edge rules
4/8
Our test
No exploit yet
CVSS
9.2
EPSS
100.0% Top 0.1%
Posts, 14d
32026-10-20: 0 posts2026-10-21: 0 posts2026-10-22: 0 posts2026-10-23: 0 posts2026-10-24: 0 posts2026-10-25: 0 posts2026-10-26: 0 posts2026-10-27: 0 posts2026-10-28: 0 posts2026-10-29: 0 posts2026-10-30: 0 posts2026-10-31: 0 posts2026-11-01: 0 posts2026-11-02: 3 posts
Published
2026-10-21
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it… More

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Ask Vigil

AI · answers from this page
Ask about CVE-2026-109619: who's covered, what to patch first, how vendors compare. I cite sources and won't help with attacks.

Workers AI (Llama 3.3). Can be wrong: check the cited source.

Severity, decoded

CVSS 4.0
Critical · 9.2 / 10

Exploitable over the network under specific conditions, with no privileges and no user interaction, leading to full loss of confidentiality, integrity and availability.

Over the internetNo login neededNo user actionHard to pull offFull compromise
How the score is built11 metrics
  • Attack vectorAn attacker can reach it over the internet; no access to your network needed.
    Network
  • Attack complexityThe attacker must first defeat a security measure, such as address randomisation, or obtain a secret.
    High
  • Attack requirementsThe attack only works under specific conditions, such as a race or a particular setup.
    Present
  • Privileges requiredNo account or login is needed.
    None
  • User interactionNo one has to click or open anything; the attack works on its own.
    None
  • Confidentiality impact (vulnerable system)An attacker can read all data the affected component holds, or the most sensitive parts of it.
    High
  • Integrity impact (vulnerable system)An attacker can change any data or files the affected component protects.
    High
  • Availability impact (vulnerable system)An attacker can take the component down completely or keep it from serving anyone.
    High
  • Confidentiality impact (other systems)Other systems' data is not exposed.
    None
  • Integrity impact (other systems)Other systems' data cannot be changed.
    None
  • Availability impact (other systems)Other systems keep working normally.
    None
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA's assessmentSSVC, from the CVE record
ExploitationActive

Attackers are exploiting this in the wild.

AutomatableNo

At least one step needs hands-on work, which slows mass attacks.

Technical impactTotal

A successful attack gives full control over the affected software or all of its data.

Public exploits

1 found
0 Metasploit0 Exploit-DB0 Scanner template1 GitHub PoCs

No exploit in Exploit-DB or Metasploit, and no scanner template. That lowers, but doesn't remove, the chance of mass exploitation.

Links are to third-party code: never run it outside an isolated lab.

Timeline

  1. 2026-10-21
    CVE published
    CVE List
  2. 2026-10-21
    AWS ships a rule
    PHP2Shell_BODY
  3. 2026-10-21
    Fastly ships a rule
    Added virtual patch for CVE-2026-109618 and CVE-2026-109619
  4. 2026-10-21
    F5 ships a rule
    PHP Remote Code Execution
  5. 2026-10-22
    Cloudflare rule names it
    Earliest entry we can see is an update
  6. 2026-10-26
    Added to CISA KEV
    Confirmed exploitation in the wild
  7. 2026-11-02
    First public exploit repository
    K2uci/PHP2ShellPOC-CVE-2026-109619
  8. 2026-11-02
    First social mention we saw

Social

2026-10-20: 0 posts2026-10-21: 0 posts2026-10-22: 0 posts2026-10-23: 0 posts2026-10-24: 0 posts2026-10-25: 0 posts2026-10-26: 0 posts2026-10-27: 0 posts2026-10-28: 0 posts2026-10-29: 0 posts2026-10-30: 0 posts2026-10-31: 0 posts2026-11-01: 0 posts2026-11-02: 3 posts

Exploit repos · unvetted, don't run

Top posts

  • YogiBear_XRP@Jryck791·

    Why I’m holding the launch of the application: Since PHP2Shell (CVE-2026-109618 / CVE-2026-109619) was disclosed and patched around October 20–21, the active threat environment has been elevated. Confirmed real-world PHP2Shell activity so far has been limited (no widespread mass

    View on X
  • GEDX Agency@gedxagency·

    1/ 🚨 PHP2Shell: si tu web corre en PHP 8.2–8.5, parcha hoy. CVE-2026-109618 y CVE-2026-109619 → RCE sin autenticación, CVSS 9.2. CISA ya las tiene en KEV (explotación activa). https://t.co/DKzWdxcFFJ

    View on X

Vendor statements

Quoted
CloudflareWAF Managed Rules20 quotesBlocks by default

Named by 2026-10-22; the first entry is an update, so the rule may be older.

2026-10-22Updated…c438d5ddSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619). Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…0a0c2f64Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…545d163cSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…212afcc9Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…1867b12eSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…9d9c073dSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…48143645Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…b5ccf32fSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619). Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…bcd95984Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #2. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…82dab691Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…24b1a4c6Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…302ede46Source
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #5. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…7975ce1bSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #6. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-22Updated…e8d613faSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #7. Previous action: Block. New action: N/A. Rule metadata description refined. Detection unchanged.
2026-10-28Updated…9d9c073dDefault: BlockSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6. Previous action: Block. New action: Block. Rule detection updated.
2026-10-28Updated…7975ce1bDefault: BlockSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560) #6. Previous action: Block. New action: Block. Rule detection updated.
2026-10-30Updated…545d163cDefault: BlockSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: Block. Rule detection updated.
2026-10-30Updated…82dab691Default: BlockSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #3. Previous action: Block. New action: Block. Rule detection updated.
2026-10-30Updated…212afcc9Default: BlockSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: Block. Rule detection updated.
2026-10-30Updated…24b1a4c6Default: BlockSource
PHP Remote Code Execution Attack (CVE-2026-109618, CVE-2026-109619) #4. Previous action: Block. New action: Block. Rule detection updated.
AWSAWS WAF Managed Rules2 quotesRule published

First rule 2026-10-21, the day the CVE was published.

2026-10-21New ruleSource
PHP application managed rule group This release updates the following rules: PHP2Shell_BODY: Released static version 2.3 of this rule group. The new PHP2Shell_BODY rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see NIST: National Vulnerability Database: CVE-2026-109619 . For CVE-2026-109618 , the SizeRestrictions_BODY rule in the AWS WAF Core rule set (CRS) managed rule group adds protection by blocking…
2026-10-22UpdatedSource
PHP application managed rule group This release updates the following rules: PHP2Shell_BODY_Extended: Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619 .
Microsoft AzureFront Door and Application Gateway WAF (DRS)No public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. The rule tables name CVEs but carry no dates, so Azure is left out of every time-to-rule figure.

Google CloudCloud Armor preconfigured WAF rulesNo public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. Google names few CVEs: the release notes start in May 2024 and the rules reference lists CVEs without dates. Its cve-canary rules are opt-in.

FastlyNext-Gen WAF virtual patches1 quoteRule published

First rule 2026-10-21, the day the CVE was published.

2026-10-21New ruleSource
Added virtual patch for CVE-2026-109618 and CVE-2026-109619. Fastly has created a virtual patch for CVE-2026-109618 and CVE-2026-109619 (php2shell) that is now available within your account. On 10/21/2026, two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (php2shell), were announced. They may allow unauthenticated attackers to achieve remote code execution (RCE) or cause a denial of service (DoS). You may be affected if you run a PHP version earlier than 8.5.12, 8.4.27, 8.3.…
F5Attack signatures (Distributed Cloud WAF)1 quoteRule published

First rule 2026-10-21, the day the CVE was published.

2026-10-21New rule200204113Source
Added: signature 200204113 "PHP Remote Code Execution" (Server Side Code Injection, risk High), systems: PHP. References: CVE-2026-109619.
AkamaiApp & API Protector (Adaptive Security Engine)No public source

This vendor publishes no machine-readable rule changelog we can check.

OWASP CRSCore Rule Set (open source, used inside many WAFs)No public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. CRS rarely names CVEs: it relies on generic detections. Our own lab measures what it actually blocks.