CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-109618
Advisory Summary
🔶 Vulnerabilities in PHP Affecting Cisco Products: October 2026
⚠️ Security Alarm (CRITICAL): PHP “PHP2shell” RCE path
Cisco highlights two critical PHP vulnerabilities released by the PHP Foundation (Oct 21). These issues can be leveraged for remote code execution (RCE) via memory/state manipulation—tracked under the internal label “PHP2shell.”
- CVE-2026-109618 — RCE via OOM corruption
- CVE-2026-109619 — RCE via stale global state
- Any affected Cisco products that run or embed PHP (directly or indirectly) could face RCE risk, potentially enabling attacker-controlled code paths if exploit conditions are met.
- The criticality implies high urgency for patching/mitigation and validation across environments where PHP execution occurs (including management interfaces, web components, plugins, or integrated services).
- If a product is not listed in Cisco’s advisory, Cisco states that its review indicates the product is not affected by this vulnerability.
- Therefore, the immediate action is to cross-check your exact product + version against Cisco’s advisory scope.
- Restrict management/web access to trusted networks (ACLs/VPN).
- Enforce least privilege and reduce exposure of internet-facing services.
- Increase logging/alerting on abnormal POST/parameter behaviors.
đź“Ś
Reference: Vendor Advisory