Statement on CVE 2026-109619 PHP - RCE via Stale Global State Vulnerability

October 21, 2026

Information

The PHP - RCE via Stale Global State is a vulnerability in PHP’s global state management that may allow references to previously freed memory to persist across requests, potentially enabling an attacker to exploit stale memory references and achieve remote code execution (RCE).

For additional information, please refer to NIST. CVE-2026-109619.

Risk

Medium

Response

Melissa Data Corporation (“Melissa”) was not impacted by the PHP - PHP - RCE via Stale Global State vulnerability. Melissa has performed a thorough investigation of both in-house built APIs, web interfaces, and vendor supplied solutions. Melissa has taken the necessary steps to update any affected versions to fixed versions and confirm no impact because there are no indicators of compromise. Melissa will continue to follow all guidance provided for this vulnerability as necessary to prevent any future risks.