Security Advisory: CVE-2026-109619¶
Summary¶
PHP may retain request-owned global state after a request ends. A later request handled by the same worker can encounter that stale state before normal request initialization, potentially resulting in a use-after-free and remote code execution (RCE).
Severity¶
Critical — CVSS 4.0: 9.2
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected CEP Releases¶
The main CEP runtime before 1.17.6 contains the affected PHP code. CEP's default configuration disables session upload progress, which removes one confirmed FPM attack path. The upstream advisory describes other conditional producer/consumer paths; disabling upload progress alone does not rule them all out.
Fixed Version¶
CEP 1.17.6 includes the upstream PHP fix in its main runtime.
Recommendation¶
Upgrade to CEP 1.17.6 or later. Treat earlier main-runtime releases as potentially affected. There is no complete general-purpose configuration mitigation for every path described by the upstream advisory.