CVE-2026-109619PHP2Shell — Fatal-Error Use-After-Free in PHP
After a fatal error, the scripting language (PHP) can keep state that points at freed memory, and a later request treats it as live data, which can lead to RCE without a login. Versions since 5.4 are affected, and attacks began before the patch.
Read the risk
THE VITAL STATS- CVSS score
- 8.1/ 10 CVSS v3.1
- EPSS probability
- 99.9% Likelihood of exploitation
- Attack complexity
- High Conditions needed to exploit
- Vendor score
- 9.2 (CVSS 4.0), source as of 2026-11-04
- Known exploited
- Yes — CISA KEV
- CVE published
- 2026-10-21
- Added to KEV
- 2026-10-26
- CISA due date
- 2026-10-29
- Exploit published
- Yes
- Confidence
- medium
- Kill chain
- initial access
- MITRE ATT&CK
- T1190
- Severity
- critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Public exploitYes, from a curated source as of 2026-11-04; the NVD record carries no exploit tag. Public proofs of concept do not work against a default PHP installation.
Also known asPHP2Shell
AffectedPHP 5.4 and later serving web requests, PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed
Attacker needsNetwork access to a PHP web endpoint and specific conditions on the target; public exploits mostly need a local file inclusion bug in the application.
Fixed inPHP 8.5.12, PHP 8.4.27, PHP 8.3.36, PHP 8.2.35
Behind the card
5 REFERENCES- 01CVE recordNVD recordnvd.nist.gov
- 02CISACISA Known Exploited Vulnerabilities catalogcisa.gov
- 03Vendor advisorymicrosoft.commicrosoft.com
- 04Writeupsansec.iosansec.io
- 05Vendor advisorygithub.comgithub.com
Field-level provenanceTRACE THE SOURCES +
Which source supports each field, when it was retrieved, and who extracted it.
| Fields | Source | Retrieved | Extractor | Confidence |
|---|---|---|---|---|
| cvss, exploitation.attack_complexity, published_at, references | nvd.nist.gov | 2026-11-04 | scrty-crds-pipeline/0.1 | high |
| exploitation.known_exploited, exploitation.kev_added, exploitation.kev_due | cisa.gov | 2026-11-04 | scrty-crds-pipeline/0.1 | high |
| epss | api.first.org | 2026-11-04 | scrty-crds-pipeline/0.1 | high |
| title, subtitle, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites | nvd.nist.gov | 2026-11-04 | claude-code | high |
| exploitation.exploit_available, exploitation.exploit_override | sansec.io | 2026-11-04 | human | high |
| cvss_vendor | sansec.io | 2026-11-04 | human | high |
| aliases, affected | microsoft.com | 2026-11-04 | human | high |
| remediation | microsoft.com | 2026-11-04 | claude-code | high |
| aliases, affected | sansec.io | 2026-11-04 | human | high |
| remediation | sansec.io | 2026-11-04 | claude-code | high |
Printing history
THE RECORD- r1Initial base card
First printing. This card has not been reprinted since publication.