Vulnerabilities in PHP Affecting Cisco Products: October 2026

On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities:

CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state

For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w ["https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"] and GHSA-6wmf-4rv5-p3rp ["https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"]. These vulnerabilities are being referenced as PHP2shell.

For information about Splunk products and offerings, see Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Splunk Products - October 2026 ["https://advisory.splunk.com/advisories/SVD-2026-1013"].

Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.

This advisory will be updated as additional information becomes available.

CVE-2026-109618 — Vulnerabilities in PHP Affecting Cisco Products: October 2026 CVE-2026-109619 — Vulnerabilities in PHP Affecting Cisco Products: October 2026