TrueSource by Broadcom Delivers Remediated PHP Software in Under 60 Minutes

On October 21, the PHP Foundation fixed and released two critical RCE vulnerabilities. Broadcom engineers acted immediately, ensuring that our products and the hardened images we provide to TrueSource Trusted Artifacts customers and Bitnami were patched and released within the hour. If exploited, these specific vulnerabilities, CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale state), allow unauthenticated remote code execution, allowing an unauthenticated attacker to execute arbitrary code on the host system.

TrueSource by Broadcom protects customers from open source software vulnerabilities across libraries, container images, and data engines. Since Broadcom was actively tracking and preparing for the pending release, which was moved up a day earlier after the CVE IDs were leaked, our engineering team acted immediately.

As a maintainer of multiple OSS projects for over two decades, our approach to the many security embargos we've participated in is coordinated disclosure, with all parties in agreement. This strict adherence to upstream embargoes reflects Broadcom's commitment to responsible disclosure and the health of the broader open source software ecosystem.

This commitment extends directly to how Broadcom approaches software stewardship through its maintainer-first engineering principles, informed by decades as the steward and maintainers of Spring, RabbitMQ and Bitnami. In 2026 to date, the Spring team published fixes for 211 CVEs across 35 projects, shipping more than 1,000 patched releases across supported branches. Some were found by our own analysis of the projects we maintain; others were responsibly and privately reported to us by external security researchers. In both cases, coordinated disclosure and upstream collaboration enable us to ship verified fixes before details become public. Just this week, Broadcom privately and responsibly released patches to our most critical digital infrastructure customers.

While embargoes aren’t a perfect system, they remain the most effective mechanism available when executed responsibly. Broadcom will not risk the safety and security of customers or the broader community by bypassing maintainers or publishing uncoordinated patches. TrueSource builds on decades of experience in packaging and hardening based on our Bitnami technology, honoring upstream embargoes to remain good software supply chain citizens. Specifically, we held our images until the PHP Foundation published, then released TrueSource images for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 less than an hour later—with the free Bitnami images following that same afternoon. For a full list of remediated components, see the following knowledge base article 460156.

To bridge the gap between emergency remediation and standard operations, TrueSource combines rapid response with clear SLAs. While our official response timelines commit to delivery within 2 business days of a verified fix being released by the upstream source, our pipeline consistently over-achieves in this regard.

As a result, existing TrueSource customers with the Bitnami package for PHP-FPM minimal image in their catalogue can simply redeploy to update to a patch version with mitigations for these CVEs, ensuring full supply chain integrity without breaking changes.

Separately, the core components of VMware Tanzu Platform and VMware Tanzu Data Intelligence are not affected by these vulnerabilities. Tanzu Platform customers running PHP apps on Tanzu Platform, the patched PHP Buildpacks were available in less than two hours.

Tanzu Platform customers can deploy these PHP fixes across their entire portfolio with a single command.