WhatBrokeToday
Today's Trends
criticalInvestigatingPHPvCVE-2026-109619

PHP Group PHP: CVE-2026-109619 (Stale Internal Request-State) Broken

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

A critical security vulnerability (CVE-2026-109619) affecting the PHP language has been published. Affected systems should apply vendor-provided mitigations to prevent exploitation, following CISA guidance.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

Under active investigation. No report has identified a root cause yet.

Evidence

3 reports · 3 CVEShow
  1. [1]
    CVE First report
    PHP Group PHP: CVE-2026-109619 (Stale Internal Request-State)(opens security advisory in a new tab)

    Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching…

    by CISA KEV 0upvotes 0comments

  2. [2]
    CVE
    PHP Group PHP: CVE-2026-109618 (Memory Corruption)(opens security advisory in a new tab)

    Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching…

    by CISA KEV 0upvotes 0comments98% match

  3. [3]
    CVE
    Linux Kernel: CVE-2026-46300 (Missing Initialization of a Variable)(opens security advisory in a new tab)

    Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching…

    by CISA KEV 0upvotes 0comments93% match

Timeline

  1. First report on security advisory

    PHP Group PHP: CVE-2026-109619 (Stale Internal Request-State)

    Source