PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 - Use-After-Free Remote Code Execution CVE-2026-109619
- Severity
- EPSS Score
- EPSS Percentile
- Vulnerability description
- Not available
- Risk description
- Not available
- Recommendation
- Not available
- References
- https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rphttps://www.php.net/archive/2026.php#2026-10-21-5https://www.openwall.com/lists/oss-security/2026/10/21/7https://calif.io/php2shell/https://www.wiz.io/blog/php2shell-php-rcehttps://nvd.nist.gov/vuln/detail/CVE-2026-109619
- Codename
- Not available
- Detectable with
- Network Scanner
- Scan engine
- Nuclei
- Cisa Kev
Yes- Exploitable with Sniper
- No
- CVE Published
- Oct 21, 2026
- Detection added at
- Software Type
- Not available
- Vendor
- php
- Product
- php
Detect this vulnerability now!
Check your clients' targets (or your own) for this vulnerability and thousands more! Get proof for validation with our ethical hacking toolkit.