PHP Stale Internal Request‑State Vulnerability (CVE‑2026‑109619) Enables Unauthenticated Remote Code Execution
What It Is — The PHP runtime contains a “stale internal request‑state” flaw that lets an unauthenticated attacker inject and execute arbitrary code on the host. The issue resides in the way PHP re‑uses internal request structures across separate HTTP calls, allowing a crafted request to corrupt the state of a later request and trigger code execution. The vulnerability is publicly listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is assigned CVE‑2026‑109619. No public exploit code has been released, but the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a 9.8 Critical base score. The PHP Group has issued an advisory and is preparing a patch; customers are urged to apply updates as soon as they become available.
Affected Products – PHP Group PHP (all supported versions prior to the forthcoming security release).
Why It Matters for Trust & Control Assurance – The flaw tests an organization’s patch‑and‑vulnerability‑management controls; a lapse lets attackers bypass authentication entirely.
Recommended Actions –
- Verify the exact PHP version in use across all web‑application servers.
- Apply the vendor‑released patch immediately once available; if a patch is not yet released, implement temporary mitigations such as disabling the affected request‑handling modules or enforcing strict input validation.
- Record the remediation step in your change‑management system to provide auditable evidence of control execution.
Source: CISA KEV – CVE‑2026‑109619