Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| php-src | php | < 8.2.35 | 8.2.35 |
| php-src | php | < 8.3.36 | 8.3.36 |
| php-src | php | < 8.4.27 | 8.4.27 |
| php-src | php | < 8.5.12 | 8.5.12 |
Miggo AIRoot Cause AnalysisCVE-2026-109619 is a cross-request use-after-free in PHP's worker-persistent global state. The confirmed exploitation path is the fatal-error backtrace: with fatal_error_backtraces enabled, zend_error_zstr_at() stores a request-owned backtrace in the executor global EG(last_fatal_error_backtrace). A fatal error (e.g., OOM) aborts the request before the matching reset, and zend_deactivate() does not clear that global before the request heap is freed. The worker survives with a dangling pointer. On the next request handled by the same worker, an early diagnostic (e.g., an INI warning before normal executor initialization) re-enters zend_error_zstr_at(), whose ZVAL_UNDEF(&EG(last_fatal_error_backtrace)) destroys the stale zval and follows attacker-reclaimed heap memory, yielding a use-after-free that can be developed into remote code execution. The patch (commit 31c0ea7d7ff1d1fccb6492e52dab544011628065) fixes this by replacing the OOM longjmp/bailout with a delayed graceful OOM (zend_handle_delayed_oom in zend_execute_script), zero-initializing the new delayed_oom state in executor_globals_ctor, initializing interned_strings_fallible in compiler_globals_ctor, and adding cleanup in zend_deactivate. The functions listed are the ones modified by the patch that contain or directly process the stale global state; zend_error_zstr_at and zend_deactivate are the core producer/consumer and the missing-reset site respectively.
zend_error_zstr_atZend/zend.c
zend_deactivateZend/zend.c
zend_execute_scriptZend/zend.c
executor_globals_ctorZend/zend.c
compiler_globals_ctorZend/zend.c