CISCO: – Reference: Cisco Security Advisory – cisco-sa-php-october26-Jj384Daq

CISCO Security Advisory

Published Date: Not specified

CVE: CVE-2026-109618

Advisory Summary

📅 October 21, 2026

🔷 🛡️ Vulnerability Watch: Critical PHP RCE in Cisco-Linked Environments (PHP2shell)
Cisco security intelligence highlights a Critical PHP security release from the PHP Foundation that impacts environments where vulnerable PHP components are used within Cisco products or their supporting stacks.

⚠️ 🚨 What’s New (Critical)
Two PHP vulnerabilities are being tracked under the “PHP2shell”

• CVE-2026-109618 — RCE via OOM corruption
• CVE-2026-109619 — RCE via stale global state

These are both remotely exploitable concepts consistent with memory/state handling flaws that can lead to code execution.

• Server/application takeover through crafted requests
• Persistence paths depending on how the device/application environment is configured
• Lateral movement leverage if systems run adjacent services or share credentials/configs

• Block direct internet access to PHP endpoints where possible
• Strengthen WAF/IPS rules and review logs for anomalous request patterns tied to exploitation attempts
• Enforce least-privilege for any service accounts running PHP

-2026-109618

Reference: Vendor Advisory