ID:13129 - Exploit for Use-after-free in PHP - CVE-2026-109619

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to disclose memory and execute arbitrary code with the web worker's privileges.

The vulnerability exists due to use-after-free in PHP's request lifecycle and persistent worker global state when operations access request-owned memory after it has been freed and before normal initialization of a subsequent request. A remote attacker can send crafted HTTP requests that leave stale state after interrupted operations or shutdown diagnostics, then trigger early error or session handling in another request processed by the same worker to disclose memory and, with a strategically crafted heap layout, execute arbitrary code.

Remediation