In response to the PHP Foundation’s October 21 disclosure of two critical security flaws in the core PHP runtime engine (CVE-2026-109618 and CVE-2026-109619), Broadcom’s security and engineering teams have thoroughly reviewed our information technology environment and software product portfolio, including third-party dependencies, to assess potential exposure.
Specific details of our response efforts and findings are summarized below and are subject to change as circumstances evolve. Broadcom will update this page — or the advisories linked below — with any additional disclosures or guidance if needed.
Corporate Infrastructure and Services: Broadcom’s Global Technology Organization has conducted comprehensive asset reviews to identify potentially affected systems. Isolated exposures were promptly mitigated, our security solutions were tuned to detect and prevent exploitation attempts, and no compromise of any infrastructure has been discovered.
Broadcom Products: Our product divisions have reviewed their software for any PHP dependencies and, for the small subset of products identified with potential exposure to the “PHP2shell” vulnerabilities, those teams are releasing fixes. Additional information, including any necessary patches, is available within the following advisories:
Agile Operations Division — zero affected products
Application Networking and Security Division — zero affected products (see Avi Load Balancer and vDefend KB articles)
Brocade Storage Networking Division — zero affected products
Enterprise Security Group — one affected product
Identity Management Security Division — four affected products
Mainframe Software Division — zero affected products
Payment Security Division — zero affected products
Tanzu Division — three affected products
VMware Cloud Foundation Division — zero affected products
For additional expert insights into the threats posed by the PHP2shell vulnerabilities — including information how our security products (Symantec/CarbonBlack, Avi WAF and vDefend Gateway Firewall) can mitigate exposure to these threats — check out the latest blog posts published by the Symantec Threat Hunter team , the VMware Application Networking and Security Division and the TrueSource team .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
