CISCO: 🗓️ Calendar: October 23, 2026

CISCO Security Advisory

Published Date: Not specified

CVE: CVE-2026-109618

Advisory Summary

🔐 ⚠️ Critical: PHP RCE vulnerabilities impacting Cisco-adjacent software stacks (PHP2shell references)

📌 What happened
On October 21, 2026, the PHP Foundation released a Critical security update addressing two remote code execution (RCE) vulnerabilities. Cisco’s advisory highlights these issues as PHP2shell:

• CVE-2026-109618 — RCE via OOM corruption
• CVE-2026-109619 — RCE via stale global state

📍 Where to verify impact
Cisco notes: if a Cisco product is not listed in the advisory, it is not affected (per Cisco’s review). This is important for scoping—don’t assume universal exposure across all deployments that may include PHP.

• Both issues are Critical and are explicitly RCE—meaning an attacker may be able to execute code on systems running vulnerable PHP components.
• Real-world exposure typically depends on whether the vulnerable PHP runtime is used directly or indirectly by the affected Cisco product/software in your environment.

• Any web-facing interfaces processing attacker-controlled inputs through PHP
• Any services/scripts that run with elevated privileges or access sensitive data
• Confirm versions/builds of PHP components match the fixed guidance
• Run regression checks for the impacted applications/services

• Downtime windows: PHP component upgrades may require service restarts—plan maintenance accordingly.
• Configuration drift: Ensure the deployed runtime versions truly match the patched target across clusters/HA pairs.
• Monitoring gaps: RCE attempts may look like normal web traffic until payload execution—enable/verify security logging and alerting.

📌 Security references

-2026-109618 -2026-109619

Reference: Vendor Advisory