KB article

vDefend: Impact Evaluation of PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been publicly disclosed by the PHP project. These vulnerabilities may allow for remote code execution without authentication.

The vulnerabilities allow to create an out-of-memory condition =remove "allow" that may result in memory corruption. This corruption may lead to unauthenticated remote code execution.

Not affected : VMware vDefend components do not use PHP and are not affected by the two PHP vulnerabilities.

All vDefend components including Distributed firewall, Gateway Firewall, Advanced Threat Prevention, Security Services Platform, License hub for vDefend and Avi, and associated VCF components remain unaffected.

****** To protect PHP-based applications with VMware vDefend, perform the following actions *******

Deploy Virtual Patching at the Perimeter: Enable the VMware vDefend Gateway Firewall with IDS/IPS signatures specifically covering PHP Remote Code Execution (RCE) vulnerabilities—such as the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619)—to inspect and automatically block malicious exploit attempts in North-South traffic.

Enforce Micro-Segmentation: Utilize VMware vDefend Distributed Firewall (DFW) to segment internal PHP application workloads and restrict East-West communication, preventing lateral movement within the data center if an endpoint is targeted.

Enable Network Traffic Analysis (NTA) & Malware Prevention: Activate Advanced Threat Prevention (ATP) features, including NTA and fileless memory analysis, to monitor runtime behaviors and detect unauthorized payload executions or anomalous network scans across workloads.

Apply Automated Tag-Based Rules: Tag affected PHP workloads within NSX Manager so dynamic security groups automatically apply emergency virtual patching rules across all instances without requiring individual rule updates or downtime.

For any questions or further technical assistance, please reach out to the vDefend Support team through the Broadcom support portal.

VMware vDefend Blog - Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAF

VMware vDefend Threat Intelligence Service – IDPS Signatures

VCF: Impact Evaluation of PHP issues CVE-2026-109618 and CVE-2026-109619 of VMware by Broadcom product portfolio

VMware Avi Load Balancer - Mitigation for CVE-2026-109618 and CVE-2026-109619

Security advisory: Critical remote code execution vulnerabilities, update now

National Vulnerability Database-CVE-2026-109618 Detail

National Vulnerability Database-CVE-2026-109619 Detail