{"id":"EM-20261029-BAZ9","url":"https://cyber.eventmonitor.net/incident/EM-20261029-BAZ9/","type":"cve","title":"PHP Stale Internal Request-State Vulnerability","subtitle":"CVE-2026-109619","subject":"CVE-2026-109619","status":"Confirmed","severity":"high","affected":["PHP Group PHP"],"headline":"21 hours from first report to confirmed exploitation.","born":"2026-10-29T08:40:28.202Z","firstSignal":"2026-10-28T12:00:00.000Z","lastSignal":"2026-10-30T16:46:49.009Z","updated":"2026-11-04T09:24:33.782Z","revision":4,"life":[{"status":"Born","at":"2026-10-29T08:40:28.202Z","why":"second independent source: C123 Provider status pages (Statuspage)"},{"status":"Developing","at":"2026-10-29T08:40:28.202Z","why":"signals keep joining"},{"status":"Confirmed","at":"2026-10-29T08:40:28.202Z","why":"CISA added it to Known Exploited Vulnerabilities"}],"changeLog":[{"at":"2026-10-28T12:00:00.000Z","what":"First signal: C1 CISA Known Exploited Vulnerabilities"},{"at":"2026-10-29T08:40:28.202Z","what":"Born: second source, C123 Provider status pages (Statuspage). Page EM-20261029-BAZ9 created."},{"at":"2026-10-29T08:40:28.202Z","what":"Status: Confirmed (CISA added it to Known Exploited Vulnerabilities)"},{"at":"2026-10-29T18:00:34.000Z","what":"Source joined: C143 Palo Alto Unit 42"},{"at":"2026-10-29T23:54:00.000Z","what":"Source joined: C45 Palo Alto Networks Security Advisories"},{"at":"2026-10-30T16:46:49.009Z","what":"Source joined: C56 AlienVault OTX pulses"}],"stages":[{"name":"Disclosed","at":"2026-10-21T14:17:09.823Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-10-21T14:17:09.823Z","detail":"CVSS 9.2 · EPSS 100.0%"},{"name":"Exploited","at":"2026-10-29T08:40:28.202Z","detail":"C1 CISA KEV, fix by 2026-10-29"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-10-29T23:54:00.000Z","detail":"C45 published"},{"name":"Resolved","at":null,"detail":"When fixed: KEV deadline 2026-10-29, then 14 quiet days"}],"signals":[{"at":"2026-10-28T12:00:00.000Z","source":"C1","sourceName":"CISA Known Exploited Vulnerabilities","role":"Exploited List","severity":3,"title":"CVE-2026-46300 added to KEV: Linux Kernel Mi ing Initialization of a Variable Vulnerability","text":"Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"at":"2026-10-29T08:40:28.202Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Linode: Cu tomer Security Advi ory: PHP Remote Code Execution Vulnerabilitie","text":"postmortem. On October 10, 2026, Akamai became aware of two zero-day remote code execution \\(RCE\\) vulnerabilities affecting the PHP core engine, tracked as CVE-2026-109618 and CVE-2026-109619. Akamai began a platform-wide investigation, and deployed global Web Applicatio","url":"https://stspg.io/5yrzq18zhvjz"},{"at":"2026-10-29T18:00:34.000Z","source":"C143","sourceName":"Palo Alto Unit 42","role":"Research & News","severity":2,"title":"Threat Brief: Critical Vulnerabilitie  in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)","text":"CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) appeared first on Unit 42 .","url":"https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/"},{"at":"2026-10-29T23:54:00.000Z","source":"C45","sourceName":"Palo Alto Networks Security Advisories","role":"Vendor","severity":3,"title":"CVE-2026-109618 Impact of Critical Vulnerabilitie  in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Network  Product  (Severity: CRITICAL)","text":null,"url":"https://security.paloaltonetworks.com/CVE-2026-109618"},{"at":"2026-10-30T16:46:49.009Z","source":"C56","sourceName":"AlienVault OTX pulses","role":"Research & News","severity":2,"title":"PHP2Shell One Week Later: Honeypot Shell  on the Web, a Path to Root on Palo Alto Firewall","text":"PHP2Shell emerged from two critical PHP memory-safety vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2 and patched on October 21, 2026. Investigation of open directories uncovered 616 PHP2Shell-related files revealing widespread exploit development across multiple operators. Whil","url":"https://otx.alienvault.com/pulse/6ae4c9f97b4e07a268c06b96"}],"crowd":[],"reference":{"nvd":{"published":"2026-10-21T14:17:09.823","score":9.2,"severity":"CRITICAL","desc":"PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on thi","product":"Php","seen":1793783074499},"kev":{"added":"2026-10-26","due":"2026-10-29","ransomware":"Unknown","vendor":"PHP Group","product":"PHP","name":"PHP Stale Internal Request-State Vulnerability"},"epss":{"epss":0.99999,"pct":0.99999,"at":1793783074499},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}