First published Oct 26, 2026, 11:32:15 PM UTC · Last updated Oct 26, 2026, 11:32:15 PM UTC

CVE-2026-109619: PHP Stale Internal Request-State Vulnerability

Reported by CISA Known Exploited Vulnerabilities

The source describes a PHP vulnerability that permits unauthenticated remote code execution and calls for mitigations following vendor instructions. It also advises evaluating internet exposure and applying relevant CISA patching guidance.

Share this event

Follow: Events in United States

Manage follows

Why it matters

The source identifies remote code execution as possible and specifies mitigation and patching actions.

Generated scores

Scores are based on the cited reporting and use a 1–10 scale. Read the methodology.

Confidence: 6/10How certain the assessment is based on the clarity and evidence in the cited reporting.
Geographic reach: 1/10How widely the event reaches, from a local area (1) to worldwide impact (10).
Global importance: 2/10The event's broader significance, from limited importance (1) to major global importance (10).
Impact magnitude: 3/10The scale or severity of the real-world impact, from minor (1) to extreme (10).
Urgency: 5/10How time-sensitive the event is, from low urgency (1) to immediate attention needed (10).

Primary official sources

CISA Known Exploited Vulnerabilities CVE-2026-109619: PHP Stale Internal Request-State Vulnerability

Report an issue

Read our editorial process and corrections policy.

Continue exploring

Related developments reported in the last 30 days. These are not necessarily ongoing incidents.

Same topic
CVE-2026-109618: PHP Memory Corruption VulnerabilityOct 26, 2026, 12:00 AM UTC
The source describes a PHP memory corruption vulnerability that allows unauthenticated remote code execution and calls for mitigations under vendor instructions. It also directs stakeholders to assess internet exposure and follow applicable CISA guidance.
Same topic
TfL disruption — Bakerloo LineOct 25, 2026, 4:27 PM UTC
Severe delays are reported on the Bakerloo Line while a signal failure is being fixed. Tickets are accepted on specified bus and rail services via any reasonable route.
Same topic
Project Gigabit network build contract - North DorsetOct 23, 2026, 2:56 PM UTC
A Project Gigabit network-build contract was awarded to Wessex Internet for access to gigabit-capable broadband at more than 7,000 premises in North Dorset.
Same topic
Project Gigabit network build contract - CambridgeshireOct 23, 2026, 2:55 PM UTC
BDUK awarded CityFibre a Project Gigabit contract to provide up to 45,000 premises in Cambridgeshire with access to gigabit-capable broadband.
Same topic
Premises contracted and built, Project Gigabit contractsOct 23, 2026, 2:09 PM UTC
Building Digital UK reports on premises contracted and built under Project Gigabit contracts. The supplied text includes no counts or specific locations.
Same topic
KZN launches fibre pre-provisioning project in EmpangeniOct 23, 2026, 12:22 PM UTC
A fibre infrastructure pilot is being implemented at the Empangeni Phase 1A Housing Development, where 405 households are under construction. The project uses a “Pipe and Box” method to install infrastructure during construction and could serve as a model for similar developments across South Africa.

Loading related developments…

Explore events in united states