Actively exploited · Published Oct 21, 2026 · Assigned by php
CVE-2026-109619RCE via stale global state
Critical 9.2 Exploited
In plain English
A critical-severity use-after-free in PHP from PHP Group. Attackers are actively exploiting it in the wild (listed by CISA on October 26, 2026). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)9.2Critical
Exploit odds (30 days)100.0%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Oct 26, 2026
Attack tooling2Nuclei, Public PoC
CISA guidance
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Federal agencies must remediate by Oct 29, 2026.
Official description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | apcu-panel | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080 |
| AlmaLinux:8 | apcu-panel | 5.1.23-1.module_el8.10.0+3796+30ed3ef7 | ALSA-2026:87073 |
| AlmaLinux:9 | apcu-panel | 5.1.23-1.module_el9.4.0+65+49ff6472 | ALSA-2026:87072 |
| AlmaLinux:9 | apcu-panel | 5.1.23-1.module_el9.6.0+151+5f31e576 | ALSA-2026:87079 |
| AlmaLinux:8 | libzip | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080 |
| AlmaLinux:8 | libzip | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 | ALSA-2026:87073 |
| AlmaLinux:8 | libzip | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2026:87080 |
| AlmaLinux:8 | libzip | 1.6.1-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080 |
| AlmaLinux:8 | libzip-devel | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2026:87080 |
| AlmaLinux:8 | libzip-devel | 1.6.1-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080 |
| AlmaLinux:8 | libzip-devel | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 | ALSA-2026:87073 |
| AlmaLinux:8 | libzip-devel | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2026:87080 |
| AlmaLinux:8 | libzip-tools | 1.6.1-1.module_el8.6.0+3239+bedf0508 | ALSA-2026:87080 |
| AlmaLinux:8 | libzip-tools | 1.6.1-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080 |
| AlmaLinux:8 | libzip-tools | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 | ALSA-2026:87073 |
| AlmaLinux:10 | php | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:9 | php | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:9 | php | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:10 | php-bcmath | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-bcmath | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-bcmath | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-bcmath | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-bcmath | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-bcmath | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:9 | php-bcmath | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-bcmath | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:9 | php-bcmath | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:10 | php-cli | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-cli | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-cli | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-cli | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-cli | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-cli | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:9 | php-cli | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:9 | php-cli | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:9 | php-cli | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:10 | php-common | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-common | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-common | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-common | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-common | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-common | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:9 | php-common | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-common | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:9 | php-common | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:10 | php-dba | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-dba | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-dba | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-dba | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-dba | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-dba | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:9 | php-dba | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:9 | php-dba | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:9 | php-dba | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:10 | php-dbg | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-dbg | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-dbg | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-dbg | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-dbg | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-dbg | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:9 | php-dbg | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:9 | php-dbg | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-dbg | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:10 | php-devel | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-devel | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-devel | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-devel | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-devel | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-devel | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:9 | php-devel | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-devel | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:9 | php-devel | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:10 | php-embedded | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-embedded | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-embedded | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-embedded | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-embedded | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-embedded | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:9 | php-embedded | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-embedded | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:9 | php-embedded | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:10 | php-enchant | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-enchant | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-enchant | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-enchant | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-enchant | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-enchant | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:9 | php-enchant | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-enchant | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:9 | php-enchant | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:10 | php-ffi | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-ffi | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-ffi | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-ffi | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:9 | php-ffi | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-ffi | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:9 | php-ffi | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:10 | php-fpm | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-fpm | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-fpm | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-fpm | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-fpm | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-fpm | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:9 | php-fpm | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:9 | php-fpm | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-fpm | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:10 | php-gd | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-gd | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-gd | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-gd | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-gd | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-gd | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:9 | php-gd | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-gd | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:9 | php-gd | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:10 | php-gmp | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-gmp | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-gmp | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-gmp | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-gmp | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-gmp | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:9 | php-gmp | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-gmp | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:9 | php-gmp | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:10 | php-intl | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-intl | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-intl | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-intl | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-intl | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-intl | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:9 | php-intl | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:9 | php-intl | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-intl | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:8 | php-json | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-json | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-json | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:10 | php-ldap | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-ldap | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-ldap | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-ldap | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-ldap | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-ldap | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:9 | php-ldap | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:9 | php-ldap | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:9 | php-ldap | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:10 | php-mbstring | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-mbstring | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-mbstring | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-mbstring | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-mbstring | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-mbstring | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:9 | php-mbstring | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:9 | php-mbstring | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-mbstring | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:10 | php-mysqlnd | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-mysqlnd | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-mysqlnd | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-mysqlnd | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-mysqlnd | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-mysqlnd | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:9 | php-mysqlnd | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-mysqlnd | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:9 | php-mysqlnd | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:10 | php-odbc | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-odbc | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-odbc | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-odbc | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-odbc | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-odbc | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:9 | php-odbc | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-odbc | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:9 | php-odbc | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:10 | php-opcache | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-opcache | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:8 | php-opcache | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-opcache | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-opcache | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-opcache | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:9 | php-opcache | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:9 | php-opcache | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-opcache | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:10 | php-pdo | 8.3.36-1.el10_2 | ALSA-2026:87070 |
| AlmaLinux:8 | php-pdo | 8.0.30-1.module_el8.10.0+4319+26f10322.alma.1 | ALSA-2026:A013 |
| AlmaLinux:8 | php-pdo | 8.2.35-1.module_el8.10.0+4323+fc907035 | ALSA-2026:87073 |
| AlmaLinux:8 | php-pdo | 7.4.33-8.module_el8.10.0+4321+cf5fd4bb | ALSA-2026:87080 |
| AlmaLinux:8 | php-pdo | 7.2.24-1.module_el8.10.0+4315+7b734bf3.alma.1 | ALSA-2026:A011 |
| AlmaLinux:8 | php-pdo | 7.3.20-1.module_el8.10.0+4316+90ea5fe5.alma.1 | ALSA-2026:A012 |
| AlmaLinux:9 | php-pdo | 8.3.36-1.module_el9.8.0+330+fdc30075 | ALSA-2026:87079 |
| AlmaLinux:9 | php-pdo | 8.1.32-1.module_el9.8.0+326+528679fc.alma.1 | ALSA-2026:A014 |
| AlmaLinux:9 | php-pdo | 8.0.30-8.el9_8.1 | ALSA-2026:87151 |
| AlmaLinux:8 | php-pear | 1:1.10.13-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080 |
| AlmaLinux:8 | php-pear | 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7 | ALSA-2026:87073 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.18-1.module_el8.10.0+3935+28808425 | ALSA-2026:87080 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.23-1.module_el8.10.0+3796+30ed3ef7 | ALSA-2026:87073 |
Affected products (as reported)
Weakness: CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp vendor-advisory
- https://www.wiz.io/blog/php2shell-php-rce third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619 government-resource
- https://php2shell.delftintellab.com/ third-party-advisory
- https://arcticwolf.com/resources/blog/php2shell-critical-php-vulnerabilities-enable-unauthenticated-remote-code-execution/ third-party-advisory
- http://www.openwall.com/lists/oss-security/2026/10/21/7
- http://www.openwall.com/lists/oss-security/2026/10/21/16
- http://www.openwall.com/lists/oss-security/2026/10/21/17
- http://www.openwall.com/lists/oss-security/2026/10/21/23
- http://www.openwall.com/lists/oss-security/2026/10/22/2
- http://www.openwall.com/lists/oss-security/2026/10/22/14
- http://www.openwall.com/lists/oss-security/2026/10/22/15
- http://www.openwall.com/lists/oss-security/2026/10/22/16
- http://www.openwall.com/lists/oss-security/2026/10/22/19
- http://www.openwall.com/lists/oss-security/2026/10/22/20
- http://www.openwall.com/lists/oss-security/2026/10/23/4
- https://cert-portal.siemens.com/productcert/html/ssa-566512.html
- https://cert-portal.siemens.com/productcert/html/ssa-566435.html
- https://cert-portal.siemens.com/productcert/html/ssa-166980.html