CVE-2026-109619 PHP Stale Internal Request-State
- Exploited in the wild
- Since 26 Oct 2026
- Fix
- Available
What is CVE-2026-109619?
CVE-2026-109619 is a critical vulnerability in Paloaltonetworks Pan-Os, published on 21 Oct 2026.
Official description
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Which versions are affected by CVE-2026-109619?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 5.4.0 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
php Bitnami | From 5.4.0 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
php-min Bitnami | From 5.4.0 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 |
Products include Paloaltonetworks Pan-Os, Paloaltonetworks Panorama Virtual Appliance, Php Php, Siemens Ruggedcom Ape1808 Firmware.
How do I fix CVE-2026-109619?
Upgrade libphp to a fixed version for your release line: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. US federal agencies must fix it by 29 Oct 2026.
Is CVE-2026-109619 being exploited?
Yes. Attackers have exploited CVE-2026-109619 in the wild since at least 26 Oct 2026.
Public exploit code: 23 proofs of concept on GitHub.
Other vulnerabilities in Paloaltonetworks Pan-Os
- CVE-2024-3400 Palo Alto Networks PAN-OS Command Injection
- CVE-2020-2021 Palo Alto Networks PAN-OS Authentication Bypass
- CVE-2017-15944 Palo Alto Networks PAN-OS Remote Code Execution
- CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds Write
- CVE-2024-0012 Palo Alto Networks PAN-OS Management Interface Authentication Bypass
Sources
Also known as AZL-109818, BELL-CVE-2026-109619, BIT-libphp-2026-109619, BIT-php-2026-109619, BIT-php-min-2026-109619, CLEANSTART-2026-NC34833 and 8 more.