PHP2Shell · advisory
CVE-2026-109619
<?php$page = ["providers" => NVD · GHSA · KEV,"fetched" => per request,"provenance" => raw hash kept,"exploit_details" => never,];
VERIFYINGNo provider record found yet.
Official description
Critical vulnerabilities in the PHP runtime (php-src) in which certain fatal-error / out-of-memory paths could leave internal engine state unsafe for later request handling. (seed summary: provider record pending)
- Severity
- CRITICAL (seed)
- CVSS
- 9.2
- Published
- 2026-10-21 00:00:00Z
- Modified
- n/a
Affected packages / fixed versions
- php 8.5.xfixed in 8.5.12
- php 8.4.xfixed in 8.4.27
- php 8.3.xfixed in 8.3.36
- php 8.2.xfixed in 8.2.35
Agent activity
No patches recorded for this advisory.