CVE-2026-109619 is a critical-severity vulnerability. AttackerView checks PHP sites for it with a live exploit check.
Detects PHP workers that carry state from one request into the next after the heap that state pointed at has already been freed. PHP keeps global values that temporarily refer to request memory, including session state the upload progress handler publishes while the request body is still being parsed. When a request dies before the matching reset, those globals keep pointing into memory that is handed back, and the next request on the same worker reads them before its own initialization replaces them. Wiz Research disclosed this as php2shell and developed it into unauthenticated memory disclosure and remote code execution against Drupal, with no flaw in the application and no call to session_start() anywhere. The check is three ordinary multipart POSTs on one keep alive connection, so one PHP worker answers all three. The first is accepted silently and returns a fresh session cookie, which proves both that the witness is readable and that the session id being sent is legal. The second exhausts the memory limit while the request body is still being parsed. The third repeats the first byte for byte, and on a vulnerable host PHP answers it by rejecting a session id that was never sent: it read the previous request's freed memory. Nothing is written to the target, the request body is capped at 2 MB and is never adapted to the host, so a server with a large memory limit is reported as not vulnerable rather than pushed harder. CVSS 9.8. Upgrade PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12; distribution backports fix this without changing the version PHP reports, so a version string answers nothing here.
Is your app exploitable through CVE-2026-109619?
Scan your domain free