CVE-2026-109619 is the stale global state issue, tracked as GHSA-6wmf-4rv5-p3rp. PHP rates it CVSS v4.0 9.2, with the same vector shape published for CVE-2026-109618. A worker keeps error, session, object, and extension state that points at memory owned by one request. That state has to be cleared before the request heap is freed. Some operations run before the next request is fully initialized and can use the stale pointer.
PHP says a fatal error, including memory exhaustion, can abandon an operation before its matching reset. A nonfatal diagnostic during later shutdown can also repopulate error state after it was cleared. The next request on the same worker is the consumer.
Confirmed consumers
Two consumers are described as confirmed before normal initialization.
The first is an INI diagnostic. A warning, notice, or deprecation while applying settings can consume stale error state. With mod_php, .htaccess and Apache php_value settings are applied before php_request_startup(). With FPM, the early path is conditional: it depends on the frontend sending PHP_VALUE or PHP_ADMIN_VALUE parameters that produce a diagnostic. Pool values and .user.ini do not provide that same early consumer. Changing error_reporting, using @, or turning off display_errors and log_errors does not prevent the access.
The second is session upload progress, which is enabled by default and does not require the application to call session_start(). PHP says this path was validated for remote code execution against mod_php and against FPM. The FPM case depends on an application operation that can fail after startup.
On PHP 8.5, fatal_error_backtraces adds a further confirmed producer: fatal error reporting stores request-owned backtrace state that shutdown misses. PHP calls this the strongest demonstrated case for mod_php.
What a complete fix requires
PHP says the only reliable mitigation is a release that contains the complete state-reset patch. There is no generic configuration setting that covers every producer, because an application or extension can publish state the operator did not anticipate.
Until that release is installed, PHP’s specific reductions are session.upload_progress.enabled=0, set where it applies before request parsing, and fatal_error_backtraces=0 on PHP 8.5. Both require a worker restart. pm.max_requests=1 is listed as a costly way to shorten the window, not as a fix. The same advisory says to remove per-request INI that emits diagnostics and to stop attacker-reachable fatal errors where you can. Absence of those errors in historical logs is not proof the worker is safe.
Questions
Does display_errors=Off stop CVE-2026-109619?
No. PHP says the stale state is used before PHP decides whether to report, display, or log the diagnostic.