Source: cisa.gov
CVE-2026-109619 is a critical vulnerability in PHP involving a stale internal request-state flaw that enables unauthenticated remote code execution. The vulnerability affects PHP as an open-source component, meaning any product or platform leveraging PHP may be at risk. CISA has issued an alert requiring immediate patching and has listed it under BOD 26-04, which prioritizes security updates based on risk. The vulnerability is catalogued in the NVD and has been assigned a High criticality rating. CISA also references forensic triage requirements associated with BOD 26-04 implementation guidance. Organizations using PHP in any capacity are urged to apply available patches without delay to mitigate exposure to potential remote exploitation.
