CVE-2026-109619 in PHP Allows Unauthenticated Remote Code Execution

En bref

• CVE-2026-109619 affects PHP and permits remote code execution by unauthenticated attackers.
• Stale request state is identified as the condition behind the flaw.
• PHP Group and CISA recommend assessing exposure, applying mitigations, and patching.
• Internet-facing PHP deployments warrant priority review; discontinue use if remediation is not possible.

In 2026, a PHP vulnerability designated CVE-2026-109619 drew attention from the PHP Group and CISA. The defect permits an attacker to execute code remotely without first authenticating, and stale request state is tied to the issue. Because exploitation does not require credentials, any reachable PHP service could become a target if it carries the vulnerable behavior.

The risk concentrates on assets that can be reached from the internet. Internet-exposed PHP applications, APIs, and supporting services should be treated as the first priority for review. Organizations need to evaluate exposure across their estate rather than assuming internal or low-profile systems are safe.

Recommended actions from the involved parties are straightforward: apply mitigations where immediate patching is not possible, patch affected deployments, and discontinue use of systems that cannot be made safe. These steps should be documented and tracked to closure, with exceptions approved and time-bound.

For K-12 and government environments, the exposure is significant because PHP often sits behind student-facing portals, administrative tools, and integration endpoints. An unauthenticated code-execution path can turn a single reachable host into an entry point for broader network access. Defenders should not wait for exploitation evidence to begin inventory and containment.

What to watch: unusual requests that manipulate or replay request state, unexpected process or file activity on PHP hosts, and any internet-facing PHP instance missing mitigation or patch status. Confirm remediation through verification scans and retain logs for incident review.

À faire maintenant

1. Inventory every PHP deployment and label internet-facing assets for immediate review.
2. Evaluate exposure by confirming which systems run the affected PHP code path and are reachable externally.
3. Apply available mitigations first on internet-facing systems that cannot be patched immediately.
4. Patch affected PHP instances according to PHP Group and CISA guidance, then verify the change took effect.
5. Discontinue use of any deployment that cannot be patched or safely mitigated until it is rebuilt or replaced.
6. Add monitoring for anomalous request-state behavior and suspicious code execution on PHP hosts.
7. Re-scan and document closure, including approved exceptions with expiration dates.

Source originale

CISA Known Exploited Vulnerabilities