CVE-2026-109619: stale global state

The request lifecycle failure

A producer operation publishes request-owned state. A fatal interruption or a later diagnostic can prevent the expected reset or repopulate state after reset. Once the request memory is released, a subsequent operation may act on a dangling reference.

The upstream advisory describes producer and consumer conditions. The same persistent worker handles the requests. Exact paths depend on the internal state, configuration, application and extensions involved.

What configuration changes cannot promise

Disabling visible errors does not prevent the early internal access that creates this issue. The advisory describes limited workarounds for particular producers and consumers, including session upload progress and PHP 8.5 fatal error backtraces. Those measures do not cover every lifecycle path.

Worker recycling can affect feasibility and capacity. It is not equivalent to applying the complete state-reset patch. Avoid emergency changes to pool behavior without capacity testing and a rollback plan.

FPM needs attention too

The advisory validates a PHP-FPM session lifecycle path that uses an application operation after successful startup. It differs from the application-independent mod_php startup sequence. A frontend or framework label is not a reliable exemption.

Remediation evidence to retain

• The package or image revision and advisory demonstrating both fixes.
• The service restart or deployment timestamp for all workers.
• Application health and compatibility checks after replacement.
• Any suspicious logs or process evidence collected before cleanup.