PHP Stale Internal Request-State Vulnerability
PHP Group — PHP
- Added to KEV catalog
- 26 October 2026
- Federal remediation due date
- 29 October 2026
- Weakness classification (CWE)
- CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
AI Breakdown
What it is
PHP contains a memory management flaw where temporary request data is not properly cleared from global memory after a request finishes. Attackers can send specially crafted requests to read or manipulate this stale memory without needing authentication, resulting in remote code execution on the server.
Why it matters
This vulnerability carries a high CVSS score of 8.1 and allows unauthorized attackers to remotely execute arbitrary code across vulnerable systems. Although specific ransomware campaign usage is currently unknown, its presence on CISA's catalog indicates active exploitation, making internet-facing servers especially critical targets.
Recommended action
IT teams should immediately evaluate their internet exposure and apply vendor security updates or mitigations following CISA BOD 26-04 guidance. If fixes are unavailable, follow applicable cloud service guidance or discontinue use of the affected product entirely. Teams should also conduct required forensic triage to detect any potential signs of prior compromise.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://www.php.net/ ; https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-109619
NVD Technical Description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
More PHP Group Vulnerabilities
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services