- Technical severity
- CRITICAL (9.2)
- Exploitation
- confirmed-in-the-wild-by-authority
- Exposure
- company-applicability-unknown
- Response priority
- urgent
- Analytical confidence
- high
Assessment
CVE-2026-109619 affects PHP Group PHP. CISA has confirmed inclusion in its known-exploited catalog. DualScope assigns urgent response priority under the stated generic context; each company should recalculate that priority from actual inventory, exposure and compensating controls.
Evidence and claims
- confirmed: CISA lists CVE-2026-109619 in the Known Exploited Vulnerabilities catalog.
- attributed: NVD reports CVSS 9.2 (CRITICAL); this measures technical severity, not company-specific risk.
- attributed: PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
- attributed: FIRST EPSS estimates a 100.0% probability of exploitation activity in the model window; this is a model estimate, not direct observation.
Company action plan
immediate · urgent
Vulnerability management / asset owners
Applies when: The organization uses PHP Group PHP; prioritize internet-facing instances.
Action: Identify affected deployments and compare installed versions with the vendor advisory or supported fixed release. Where applicable to the organization, consult CISA KEV required actions and deadlines; federal directives do not automatically impose obligations on every reader.
Dependencies: Authoritative asset inventory, product ownership and vendor advisory access.
Verify: Export the matched inventory with version and exposure evidence; have the service owner confirm false positives.
Residual risk: Unknown or unmanaged assets may remain exposed.
near-term · urgent
Platform operations / change management
Applies when: An affected version is confirmed.
Action: Apply the vendor-supported fix or documented mitigation through normal emergency change controls. Preserve rollback and configuration backups.
Dependencies: Vendor fix guidance, maintenance window and tested rollback.
Verify: Re-scan the deployed version and validate service health and security-control telemetry after the change.
Residual risk: Remediation does not establish that prior compromise did not occur.
investigation · urgent
Detection engineering / incident response
Applies when: The vulnerable service was reachable during the exposure window or suspicious activity exists.
Action: Review vendor-recommended indicators and relevant authentication, process, network and administrative logs. Escalate anomalies under the incident-response plan.
Dependencies: Retained logs and vendor-supported detection guidance. Do not treat generic IP blocklists as proof.
Verify: Document query scope, time range, data gaps and investigation outcome separately from patch status.
Residual risk: Absence of observed indicators is not proof of absence when telemetry is incomplete.
What remains uncertain
- Company deployment and internet exposure are unknown.
What would change this assessment
- A vendor advisory changes affected or fixed versions.
- An authoritative source changes the CVE status or exploitation assessment.
- New direct incident evidence changes the known attack prerequisites or impact.
Sources and methodology
- cisa-kev · retrieved October 27, 2026
- nvd-cve · retrieved October 27, 2026
- first-epss · retrieved October 27, 2026
DualScope uses deterministic automated analysis of public sources. It does not claim firsthand testing, private telemetry or interviews.