CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-109618
Advisory Summary
🗓️ Calendar • October 23, 2026 (published)
🔷 Title: Vulnerabilities in PHP Affecting Cisco Products: October 2026
- The PHP Foundation released a Critical PHP security update addressing two Remote Code Execution (RCE) issues:
- CVE-2026-109618 — RCE via OOM corruption
- CVE-2026-109619 — RCE via stale global state
- These issues are collectively referenced as “PHP2shell”, indicating a high likelihood of attackers converting the vulnerability into shell-level execution.
- Any affected Cisco products that embed/operate on PHP components (or ingest/execute PHP in relevant workflows) could be at risk of:
- Initial RCE leading to full compromise of the application context
- Privilege escalation paths depending on deployment configuration, OS hardening, and service account permissions
- Cisco notes: If a product is not listed in the advisory, Cisco’s review indicates it is not affected.
- This makes it easier for teams to focus remediation only on confirmed impacted platforms.
- Internet-facing PHP endpoints
- Integration points where PHP execution may occur (web UI, admin panels, APIs, embedded apps)
- Look for anomalous PHP process behavior and suspicious request patterns consistent with exploitation attempts.
- Limit inbound access, enforce web application firewall rules, and reduce privileges for service accounts.
🧾 Key references to advisory details
-2026-109618
Reference: Vendor Advisory