{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-109619/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-109619/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-109619/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-109619/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-109619/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-109619"},"sightings":{"href":"/api/v1/sightings/cve-2026-109619"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-109619.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-109619\n\ninfo:\n  name: PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 - Use-After-Free Remote Code Execution\n  author: comradezephyr (Abdullah Shahid)\n  severity: critical\n  description: |\n    PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12 contain a use-after-free caused by request-owned global state that is not reset before the request heap is freed, letting unauthenticated attackers execute arbitrary code in a subsequent request handled by the same worker; exploitation requires a crafted request sequence and a reachable session or INI consumer.\n    This template performs a passive version check against the PHP version disclosed in the X-Powered-By or Server response header and does not send a crafted request. It follows same-origin redirects (same host and port); redirects to another origin are ignored so a third-party response cannot be attributed to the scanned host. Limitations: detection requires the version to be exposed, so hosts with expose_php=Off and no PHP version in the Server header, hosts behind a proxy or FastCGI configuration that strips these headers, and applications that override them are not detected. These headers can also be spoofed, so a match is only as trustworthy as the disclosed header. Builds that backport the fix while keeping the upstream version number (for example 8.2.34-1ubuntu1) still match, so a match reports an affected upstream version rather than confirmed exploitability. Pre-release or development builds of a fixed version (for example 8.2.35RC1) and responses that advertise conflicting versions in different headers are not matched.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code with the privileges of the PHP worker, leading to full compromise of the web server.\n  remediation: |\n    Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 and restart all PHP workers. Until patched, set session.upload_progress.enabled=0 and memory_limit=-1 as partial mitigations.\n  reference:\n    - https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp\n    - https://www.php.net/archive/2026.php#2026-10-21-5\n    - https://www.openwall.com/lists/oss-security/2026/10/21/7\n    - https://calif.io/php2shell/\n    - https://www.wiz.io/blog/php2shell-php-rce\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-109619\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 9.2\n    cve-id: CVE-2026-109619\n    epss-score: 0.99999\n    epss-percentile: 0.99999\n    cwe-id: CWE-416\n    cpe: cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: php\n    product: php\n    shodan-query: 'http.headers:\"X-Powered-By: PHP\"'\n    fofa-query: 'header=\"X-Powered-By: PHP\"'\n  tags: cve,cve2026,php,php2shell,rce,use-after-free,passive,kev,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    host-redirects: true\n    max-redirects: 2\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"(compare_versions(version, '>= 8.2.0') && compare_versions(version, '< 8.2.35')) || (compare_versions(version, '>= 8.3.0') && compare_versions(version, '< 8.3.36')) || (compare_versions(version, '>= 8.4.0') && compare_versions(version, '< 8.4.27')) || (compare_versions(version, '>= 8.5.0') && compare_versions(version, '< 8.5.12'))\"\n\n    extractors:\n      - type: regex\n        name: version\n        part: header\n        group: 1\n        regex:\n          - '(?im)^(?:x-powered-by:\\s*PHP/|server:[^\\r\\n]*?\\bPHP[/ ])([0-9]+\\.[0-9]+\\.[0-9]+)'\n# digest: 4a0a00473045022100b2de261b33e96282ecd7fac3a90c46979bf4b57e03c9adbfa7e1f54ae3435f1d022010ec558b2336db0d94277d5b7c51fad06387ebadc7caa4a717ac42754e10c66b:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-109619"}