CVE coverage

CVE-2026-109619

CVSS 8.1 Actively exploited (KEV) 16 detections found

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Detection rules

Source	Rule	Status	Updated
splunk	Cisco Secure Firewall - PHP2Shell Serialized Payload Activity	production	2026-10-28
splunk	Cisco Secure Firewall - PHP2Shell Suspicious Upload Activity	production	2026-10-28
splunk	Web or Application Server Spawning a Shell	production	2026-10-28
splunk	Windows Suspicious Child Process Spawned From WebServer	production	2026-10-28
splunk	PHP Session Upload Progress Serialized Payload in Upload Filename	production	2026-10-28
splunk	PHP Session Upload Progress with PHP Code in Upload Filename	production	2026-10-28
splunk	Cisco Secure Firewall - PHP2Shell Exploitation Attempt	production	2026-10-28
splunk	PHP Opening Tag in Upload Filename - Suricata	production	2026-10-28
splunk	Serialized PHP Token in Upload Filename - Suricata	production	2026-10-28
splunk	Large HTTP POST Request Failure or Missing Response - Suricata	production	2026-10-28
splunk	Large HTTP POST Request Resulting in Server Error	production	2026-10-28
elastic	Potential PHP2Shell Exploitation Attempt	production	2026-10-24
splunk	PHP Memory Exhaustion Exploitation Attempt via Multipart Request	production	2026-10-23
snort	ET INFO PHP Generic Upload Progress Session Manipulation	rev 1	2026-10-22
suricata	ET HUNTING PHP Generic Upload Progress Session Manipulation	rev 1	2026-10-22
sentinel	PHP Worker Process Spawning Shell/Recon Tool	Scheduled	—