Vulnerabilities in PHP Affecting Cisco Products: October 2026

Description

On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp . These vulnerabilities are being referenced as PHP2shell. For information about Splunk products and offerings, see Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Splunk Products - October 2026 . Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability. This advisory will be updated as additional information becomes available. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq Security Impact Rating: Critical

What to do

Install the fixed versions listed in the official advisory. If you cannot update right away, apply the workarounds or mitigations it describes and limit access to the affected service.

Details

Vendor

Cisco

Product

PHP

CVE

CVE-2026-109618, CVE-2026-109619

Affected versions

PHP 8.2: from 8.2.* to 8.2.35 (excluded) — fixed in 8.2.35
PHP 8.3: from 8.3.* to 8.3.36 (excluded) — fixed in 8.3.36
PHP 8.4: from 8.4.* to 8.4.27 (excluded) — fixed in 8.4.27
PHP 8.5: from 8.5.* to 8.5.12 (excluded) — fixed in 8.5.12 (from the advisory and NVD; check the exact builds in the official advisory)

CVSS score

9.8

Actively exploited

Not known at this time

Source

Cisco PSIRT – original advisory

Published

October 30, 2026

The description and the recommended action are quoted from the public advisory (the action is our generic advice); severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.