CVE-2026-109619: PHP'de Global Durum Hatası: Uzaktan Kod Çalıştırma Riski

PHP'nin bazı global durumları temizlenmeden eski istek verilerine işaret edebilir. Saldırgan bu durumu kullanarak sunucuda kod çalıştırabilir. Hemen PHP sürümünüzü güncelleyin ve güvenlik yamalarını uygulayın.

Türkçe özet yapay zekâ ile üretildi.

Açıklama (NVD)

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Özet bilgiler

Ürün

Php Php

CVSS v3.1

8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0

9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

%100,00 (yüzdelik 100)

CWE

CWE-416

Yama

Geçici çözüm

KEV

Eklenme: 2026-10-26 · Son tarih: 2026-10-29

Gerekli aksiyon: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Etkilenen sürümler

İlgili haberler

• Vulnerabilities in PHP Affecting Cisco Products: October 2026
• CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)
• Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
• Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)
• AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2
• CISA confirms PHP2Shell under attack as researchers clock successful exploits
• Introducing the Cloudflare PHP Capture the Flag challenge
• 26th October – Threat Intelligence Report
• PHP2Shell: What to know about two critical PHP flaws
• New Serious PHP Vulnerabilities Released and Patched

Kaynaklar

• NVD kaydı
• github.com
• www.openwall.com
• www.openwall.com
• www.openwall.com
• www.openwall.com
• www.openwall.com
• www.openwall.com
• www.openwall.com
• www.openwall.com
• www.openwall.com
• www.openwall.com
• www.openwall.com
• arcticwolf.com
• cert-portal.siemens.com
• cert-portal.siemens.com
• cert-portal.siemens.com
• php2shell.delftintellab.com
• www.cisa.gov
• www.wiz.io
• CWE-416
• CISA KEV kataloğu