CVE-2026-109619 — PHP stale internal request-state vulnerability exploited in the wild

90/100

CVE-2026-109619 is a critical PHP vulnerability allowing unauthenticated remote code execution via stale request-state. It has been added to the CISA KEV catalog due to active exploitation.

• Actively exploited (CISA KEV, added 2026-10-26)
• CVSS 9.2
• EPSS 100 %
• PHP Group
• CWE-416

Digest of 2026-10-27

Sources

• CISA — Known Exploited Vulnerabilities — CISA KEV — PHP Stale Internal Request-State Vulnerability (CVE-2026-109619)
• CERT-FR (ANSSI) — Multiples vulnérabilités dans les produits Tenable (26 octobre 2026)
• CERT-FR (ANSSI) — Multiples vulnérabilités dans les produits Tenable (23 octobre 2026)