Stale state across requests
CVE-2026-109619 concerns request-owned memory referenced by persistent worker state after that memory is freed. A later request reaching the same worker can consume the stale value before normal initialization resets it. Confirmed paths include fatal-error backtraces in PHP 8.5 and session upload-progress lifecycle handling. RCE was validated with mod_php and, through a suitable application path, PHP-FPM.
Is PHP-FPM exempt?
No. Exploitability differs by SAPI and by vulnerability. FPM terminates a child when request startup fails, preventing some demonstrated startup-only sequences. It does not eliminate application-level or cross-request state paths. Do not generalize the mod_php demonstration into identical exploitability everywhere, or use FPM as evidence that patching is unnecessary.
Upload progress and backtraces
Set session.upload_progress.enabled=0 before request parsing and restart workers to block the confirmed session lifecycle paths. In PHP 8.5, fatal_error_backtraces=0 removes the confirmed backtrace producer only. Remove invalid or deprecated per-request settings that emit early diagnostics. Hiding output with display_errors, error_reporting or @ does not stop the stale-state vulnerability. These settings do not cover every variant.
2. Install a patched build
The first fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Choose your existing supported branch or a compatible newer supported branch. Update all matching extensions with the runtime. Test application compatibility and health checks. Fetch releases or packages from PHP or the responsible vendor; an unchanged CMS or a WAF rule is not a runtime patch.
| PHP branch | Upstream releases below | First patched release | Security support ends |
|---|---|---|---|
| PHP 8.5 | < 8.5.12 | ✓ 8.5.12 | Dec 31, 2029 |
| PHP 8.4 | < 8.4.27 | ✓ 8.4.27 | Dec 31, 2028 |
| PHP 8.3 | < 8.3.36 | ✓ 8.3.36 | Dec 31, 2027 |
| PHP 8.2 | < 8.2.35 | ✓ 8.2.35 | Dec 31, 2026 |
No normal PHP project release is available for these branches. Minimal source backports exist for 7.4, 8.0 and 8.1; vendor support must be verified separately. Read guide ↗