VULNERABILITYUK NCSC all feedOpen Source Security

Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Posted by Aaron Rainbolt on Oct 21 While not yet fully confirmed, the Fediverse is reporting that the fix to at least PHP 8.5.12 may be incomplete: https://fedi.katze.sh/@elise/117479383739450605 Posted by Yves-Alexis Perez on Oct 21 @elise also sayd it seems like a *different* vulnerability: https://fedi.katze.sh/@elise/117478655339557825

Published 21-Oct-2026 17:00 UTC · First seen 21-Oct-2026 16:59 UTC

Sources

UK NCSC all feed · 21-Oct-2026
Open Source Security · 21-Oct-2026
Open Source Security · 21-Oct-2026