{"id":"CVE-2026-109619","url":"https://compromised.live/t/CVE-2026-109619","kind":"exploited_vuln","tier":1,"severity":"high","title":"PHP Group PHP: PHP Stale Internal Request-State Vulnerability","summary":"An unauthenticated remote attacker can run arbitrary code on servers due to a stale request-state flaw, and this vulnerability is being actively exploited. PHP Group PHP. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-10-26","due_date":"2026-10-29","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z","status":"active","details":"PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.","aliases":["CVE-2026-109619"],"sources":[{"name":"kev","id":"CVE-2026-109619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109619"}]}