PHP2Shell (CVE-2026-109618/19): Broadcom & VMware Impact & Mitigation
💥 The Situation
On October 21, 2026, the PHP project released emergency patches to address two critical remote code execution (RCE) vulnerabilities: CVE-2026-109618 and CVE-2026-109619.
🐛 These vulnerabilities, known as PHP2Shell, affect PHP installations serving web requests across several execution modes, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Both have a CVSS v4.0 score of 9.2 and can permit unauthenticated remote code execution. Risk and exploitability differ by configuration; the PHP project considers mod_php particularly exposed. See the official PHP security release announcement for current guidance.
The vulnerabilities stem from how PHP handles out-of-memory errors and request states:
- 🧠 CVE-2026-109618: Corrupts memory during out-of-memory (OOM) handling, treating partially initialized internal request data as valid.
- 👻 CVE-2026-109619: A use-after-free flaw where request-owned internal state survives after its backing memory has been freed.
🏛️ CISA and the UK’s NCSC strongly urge organizations to immediately apply patches (versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35). The NCSC advises that systems running unsupported, end-of-life versions (PHP 8.1 and earlier) must be taken offline if they cannot be updated.
🚨 NSA Warning: The National Security Agency (NSA) has issued an urgent advisory echoing this guidance, warning that these vulnerabilities often provide a direct path to the server’s file system or database. Their directive is clear: “If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.”
Read the Full NSA Advisory Here
🏢 What This Means for the Broadcom / VMware Portfolio
While the global threat is severe, we have established definitive impact perimeters for our core portfolio:
- ✅ VMware Cloud Foundation (VCF): Reported not vulnerable in Broadcom’s VCF core-component assessment (KB 459989). This does not establish that every optional integration, customer workload, or separate product deployed alongside VCF is unaffected. VVF: Check the applicable product/build-specific advisory; shared technology alone is not sufficient proof of unaffected status.
- ✅ Avi (Advanced Load Balancer): Verify against Broadcom’s product-specific assessment. Do not infer a definitive product vulnerability status solely from the presence or absence of PHP in an assumed component architecture; distinguish Avi appliance exposure from the PHP applications it fronts.
- 🟢 Bitnami PHP images: Confirm the exact image tag, digest and published fix status before declaring an installation remediated. Rebuild and redeploy affected containers with patched PHP images; updating a registry image does not update running containers automatically.
- ⏳ Tanzu Application Service (Cloud Foundry): Determine whether apps are using affected PHP buildpacks and monitor the official buildpack and platform advisories for fixed versions. Once a validated patched buildpack is available, stage or restage affected workloads as required; the status may differ by branch and installation.
🛑 Immediate Action Plan: Patch PHP First, WAF as Defense in Depth
Critical mitigation clarification (October 21, 2026): The PHP security team explicitly states there are no complete workarounds for these vulnerabilities; patching or upgrading PHP is required. WAF rules, IP reputation, rate limits and restricted upload handling can offer partial defense-in-depth, but they must never be presented as equivalent to a patched PHP runtime. This distinction is particularly important because exploit requests may be processed by PHP before application-level authentication or security checks. See the PHP project announcement and Cloudflare’s response analysis.
For organizations running downstream PHP workloads, review any vendor-confirmed Avi WAF coverage as a temporary additional control while deploying fixed PHP versions. Do not assume a generic Core Rule Set or an individual rule provides complete PHP2Shell coverage. Confirm applicability, parser behavior, inspection limits and false-positive impact in your own deployment.
- 🛡️ Review WAF coverage: Keep supported Avi WAF protections and appropriate reputation controls enabled, but don’t assume CRS rule 933100 is a validated PHP2Shell signature. Check Broadcom’s product-specific advisories for applicable detections and test legitimate traffic before enforcing changes.
- 🎯 Validate any temporary signatures: Some observed exploit paths involve multipart request handling and
PHP_SESSION_UPLOAD_PROGRESS. Filters aimed at those indicators can miss other paths or be bypassed through parsing differences. Use only vetted vendor guidance, test false positives and continue prioritizing runtime updates. - 🔍 Inventory & Isolate: Following CISA guidance and NCSC recommendations, strictly identify all PHP instances (including containerized php-fpm deployments) and aggressively isolate or take offline any legacy systems that cannot be patched.
📢 Update note (October 21, 2026): Individual Broadcom product assessments can change as investigations conclude. Re-check the linked vendor KBs and your product’s support advisories before making an upgrade or exposure decision. This article is a dated status snapshot, not a continuously updated vulnerability database.
📢 Update & Addendum: Broadcom Product Assessment & Official KBs
Below is a dated summary of product-specific status claims linked to Broadcom KB IDs for CVE-2026-109618 and CVE-2026-109619. Verification limitation: I could not independently open the referenced Broadcom KB content through a public browsing session on October 21, 2026. Customers with support access should verify the affected versions, component scope and latest KB revisions before relying on any “not vulnerable” conclusion. Under investigation does not mean unaffected. The table does not establish portfolio-wide coverage.
| Product | Status | Details & Knowledge Base |
|---|---|---|
| VMware Cloud Foundation (VCF) | Not Vulnerable | VCF components do not use PHP. (KB 459989) |
| Symantec VIP Service | Not Vulnerable | PHP is not used in any Symantec VIP components. (KB 459964) |
| CA Advanced Authentication | Not Vulnerable | Assessment confirmed product is not vulnerable. (KB 459977) |
| Symantec Identity Security Platform (IDSP) | Not Vulnerable | Also applies to VIP Authentication Hub / AgentMinder Identity. (KB 459975) |
| Carbon Black App Control | Under Investigation | Broadcom is actively investigating impact on App Control Server. (KB 459982) |
⚠️ Advisory note: For products listed as Under Investigation, including Carbon Black App Control in the linked KB, consult the most recent product advisory and open a support case if necessary. Do not treat an investigation status, an unreachable KB, or an assessment limited to core components as evidence that all deployed versions and integrations are safe.
Official Sources and Verification Checklist
- PHP project security releases and supported fixed versions — authoritative upstream patch guidance
- NSA advisory of October 21, 2026 — federal risk guidance
- Netherlands NCSC operational tracking repository — dated information on affected deployments and mitigation limitations
- Cloudflare’s PHP2Shell WAF response — a defense-in-depth example, not a replacement for upgrading PHP
Priority: Inventory each public-facing PHP runtime, confirm whether it is running an affected release, install vendor-fixed PHP or distributor-confirmed backported packages, restart affected workers, validate the deployed web-serving runtime (not just CLI PHP), and check software inventories for bundled PHP. Unsupported branches need vendor-supported migration or isolation.
#PHP2Shell #CVE2026109618 #CVE2026109619 #CyberSecurity #InfoSec #Broadcom #VMware #VCF #VVF #AviWAF #Tanzu #Bitnami #VulnerabilityManagement #PatchNow