External Article 459989

knowledge.broadcom.com • October 23, 2026

Impact Evaluation of PHP issues CVE-2026-109618 and CVE-2026-109619 of VMware by Broadcom product portfolio

Two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been publicly disclosed by the PHP project. These vulnerabilities may allow for remote code execution without authentication.

The vulnerabilities allow to create an out-of-memory condition that may result in memory corruption. This corruption may lead to unauthenticated remote code execution.

VMware Cloud Foundation components do not use PHP and are not affected by the two PHP vulnerabilities.

Additional Information

Impact Evaluation of PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 on vDefend components

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like WordPress and Drupal. Exploitation attempts were observed as early as October 17, four days before the patches were released. The PHP security team released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but older versions such as PHP 8.1 and below will not receive official fixes. Organizations are urged to patch immediately or isolate affected systems to mitigate risks. The vulnerabilities were discovered by researchers at Wiz and Calif, with assistance from OpenAI's AI models. 785 sources 73

Extracted Entities

External Article 459989

The full story

Extracted Entities

CVEs (2)

Platforms (1)

Tools (1)