CVE-2026-109619Critical· 9.2▾ Hadal⚠ Exploited in the wildPoC availablePHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after i…
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 50.6 · likelihood 20 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
5.8%
9.2 → 8.1
critical → high
8.1 → 9.2
high → critical
9.2 → 8.1
critical → high
Federal remediation due Oct 29, 2026
Last analysed / modified upstream
5.8% → 100%
25 GitHub repos (last check)
8.1 → 9.2
high → critical
Added to the CISA catalog on Oct 26, 2026. Federal remediation due Oct 29, 2026. View catalog ↗
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
php-src >= 8.2.* < 8.2.35php-src >= 8.3.* < 8.3.36php-src >= 8.4.* < 8.4.27php-src >= 8.5.* < 8.5.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Check the GitHub Security Advisory for mitigation strategies.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109618Critical· 9.2RCE via OOM corruption
CVE-2026-6103Medium· 4.3phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check
CVE-2026-91766Medium· 5.9When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HT…
CVE-2025-1218Low· 3.4The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them
CVE-2026-17545Medium· 6.9On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path
CVE-2025-14181Medium· 6.5The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger