Critical PHP RCE flaws may affect Cisco products
Original title: Vulnerabilities in PHP Affecting Cisco Products: October 2026
CVE-2026-109618 and CVE-2026-109619, called PHP2shell, were fixed in a PHP security release announced October 21.
Cisco published an October 2026 advisory on two critical PHP vulnerabilities that can affect Cisco products. The PHP Foundation announced a Critical PHP Security release on October 21 covering CVE-2026-109618, remote code execution via OOM corruption, and CVE-2026-109619, remote code execution via stale global state. Cisco refers to the issues as PHP2shell and says products not listed in the advisory are not affected. The feed text cuts off before the product list and remediation details.
Unconfirmed: The snippet does not state which Cisco products are affected, fixed versions, or whether the flaws are exploited.
- Related PHP advisories are GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
- Cisco points Splunk customers to a separate October 2026 PHP advisory.
- Affected and fixed Cisco product versions are not in the provided snippet.
Impact: Remote code execution via two critical PHP flaws
| Product | Affected |
|---|---|
| PHP Foundation PHP | — |
| Cisco products | — |
- 1.Check the Cisco advisory for whether a product is listed as affected.
- Products
- PHP
- Organizations
- PHP Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. These vulnerabilities are being referenced as PHP2shell.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.