Skip to content
Broadcom Addresses Critical PHP Vulnerabilities with Rapid Patching

Broadcom Addresses Critical PHP Vulnerabilities with Rapid Patching

First seen 23 Oct 2026, 03:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 04:42 UTC
  • •Two critical RCE vulnerabilities in PHP disclosed on October 21, 2026.
  • •Broadcom patched affected products within an hour of disclosure.
  • •CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution.

On October 21, 2026, the PHP Foundation disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting the PHP runtime engine. Broadcom's engineering team responded swiftly, patching their products and releasing remediated PHP software within an hour of the vulnerabilities being disclosed. These vulnerabilities allow unauthenticated attackers to execute arbitrary code on affected systems, posing a significant risk to users of PHP. Broadcom's TrueSource service ensures protection against such vulnerabilities across open-source software dependencies. The company conducted thorough reviews of its product portfolio and confirmed that while some products were affected, no compromise of corporate infrastructure was detected. Patches for affected products are being released, and further updates will be provided as necessary. The vulnerabilities have a CVSS score of 9.2, indicating their critical nature.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
PHP vulnerabilities disclosed
The PHP Foundation published details of two critical RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
Broadcom
2026-10-21
Broadcom patches released
Broadcom released patched versions of PHP software for TrueSource customers within an hour of the vulnerabilities being disclosed.
Broadcom
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-23
Broadcom response summary published
Broadcom provided an overview of their response to the PHP vulnerabilities, confirming no compromise of infrastructure and ongoing patch releases.
Broadcom

More articles in this cluster (2)

Following this threat?

Track Bitnami and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 2

Common questions

What are the CVEs associated with these vulnerabilities?
The vulnerabilities are CVE-2026-109618 and CVE-2026-109619, both published on October 21, 2026.
How quickly did Broadcom respond to the vulnerabilities?
Broadcom patched its affected products within an hour of the vulnerabilities being disclosed.
Are any Broadcom products confirmed to be affected?
Yes, some Broadcom products have been identified with potential exposure, and patches are being released.