CVE-2026-109619: remote code execution in PHP and the affected version range

What happened and what to do

The advisory, published on 21 October 2026 and discussed on the oss-sec list, describes remote code execution (RCE) caused by an obsolete global state. According to the quoted text, the affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27 and PHP 8.5 before 8.5.12. A reply by Christian Fischer, dated 21 October, warns that the title and body may suggest that only versions 8.2 to 8.5 are affected, which may lead to a wrong reading about earlier versions.

In practice, the company should first inventory every server, container and image running PHP, including runtimes embedded in legacy applications, and record the exact version of each. It should then plan the upgrade to the fixed releases and, meanwhile, treat as potentially exposed anything outside the range confirmed by the vendor. A scheduled version-collection pipeline, with alerts when a host falls below the minimum patch level and a compliance dashboard per environment, turns this one-off check into continuous monitoring.

How the consultancy can help

Diagnosis of exposure to vulnerable PHP: version survey across servers, containers and applications, ranking by criticality and an upgrade plan. Then deployment of version collection and monitoring with alerts and a dashboard, on the client's infrastructure.

Next step

If your company runs PHP in production, send a short description of your environment and your case. We will reply with a scoped proposal for diagnosis and implementation.