ESLog inGet started free
Critical 9.2 CVSS 4.0 PHP Published on 2026-10-21

PHP has various global state that temporarily points into request memory.

CVECVE-2026-109619 GHSANo GHSA advisory
View at the source View JSON Last modified at the source: 2026-10-30

Description

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Original text by NVD (NIST), public domain.

CVSS metrics 4.0

Source: security@php.net · secondary
Critical 9.2
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/
Attack vectorNetwork
ComplexityHigh
Attack requirementsPresent
Privileges requiredNone
User interactionNone
Confidentiality (system)High
Integrity (system)High
Availability (system)High
Confidentiality (others)None
Integrity (others)None
Availability (others)None

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

PHP (29)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. PHP Critical 9.8 ≥ 7.3.0 < 8.2.35
≥ 8.3.0 < 8.3.36
≥ 8.4.0 < 8.4.27
+1 2026-10-21 No
CVE-2026-91765 cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. PHP High 7.5 ≥ 8.2.0 < 8.2.34
≥ 8.3.0 < 8.3.35
≥ 8.4.0 < 8.4.26
+1 2026-09-25 No
CVE-2026-17544 Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP… PHP Critical 9.8 ≥ 8.4.0 < 8.4.24
≥ 8.5.0 < 8.5.9 2026-07-30 No
CVE-2026-17543 Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions… PHP Critical 9.8 ≥ 8.2.0 < 8.2.33
≥ 8.3.0 < 8.3.33
≥ 8.4.0 < 8.4.24
+1 2026-07-30 No

Does your server run PHP 8.2.x ≥ 5.4.0 < 8.2.35, 8.3.x ≥ 8.3.0 < 8.3.36, 8.4.x ≥ 8.4.0 < 8.4.27, 8.5.x ≥ 8.5.0 < 8.5.12?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected