CVE-2026-109619: PHP Stale Internal Request-State Vulnerability
Summary
PHP has a critical vulnerability (CVE-2026-109619) allowing unauthenticated remote code execution. Users are instructed to apply mitigations according to vendor guidance and CISA directives, prioritizing updates based on risk.
IFF Assessment
This vulnerability allows for unauthenticated remote code execution, posing a significant risk to systems.
Severity
This vulnerability allows for unauthenticated remote code execution (Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Changed, Confidentiality Impact: High, Integrity Impact: High, Availability Impact: High).
CISA KEV: Listed as actively exploited. Federal patch due: October 29, 2026. Known ransomware use: Unknown.
Defender Context
This vulnerability in PHP represents a severe threat, enabling attackers to execute arbitrary code remotely without authentication. Defenders must prioritize patching and applying vendor-recommended mitigations immediately, especially for internet-facing systems, to prevent exploitation.