PHP2Shell (CVE-2026-109618/19): Broadcom & VMware Impact & Mitigation

October 22, 2026 — Official Broadcom PHP2Shell Response

Official response hub: Broadcom Response to PHP2Shell Vulnerability. Use this central Broadcom page alongside the dated Enterprise Security Group advisory 39404 and individual product KBs for current product-specific determinations.

Key findings: Broadcom lists Carbon Black App Control Server as Affected (advisory 39411); Carbon Black App Control Agent as Not Vulnerable; and Symantec Endpoint Protection Manager (SEPM) as Affected (product advisory 39421); and CloudSOC CASB and Content Analysis as Under Investigation in the October 22 Enterprise Security Group advisory 39404. Symantec Endpoint Protection (SEP) Agent remains Not Vulnerable. VCF remains Not Vulnerable under KB 459989. Apply each assessment only to its stated product scope; customer-hosted PHP workloads must be evaluated and patched separately.

New official VMware vDefend assessment (October 22): NOT AFFECTED. Broadcom KB 460110 explicitly confirms that VMware vDefend components do not use PHP and are not affected by CVE-2026-109618 or CVE-2026-109619. The KB covers Distributed Firewall, Gateway Firewall, Advanced Threat Prevention, Security Services Platform, the vDefend/Avi license hub, and associated VCF components. Broadcom separately describes how vDefend segmentation, gateway IDS/IPS and ATP can help protect customer-hosted PHP workloads. This protective role does not mean the vDefend product is vulnerable.

Remediation: Security controls such as WAF and endpoint detections are defense in depth, not a substitute for patched PHP. This update links Broadcom’s response hub without attributing additional unverified statements to its embedded content.

💥 The Situation

On October 21, 2026, the PHP project released emergency patches to address two critical remote code execution (RCE) vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

🐛 These vulnerabilities, known as PHP2Shell, affect PHP installations serving web requests across several execution modes, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Both have a CVSS v4.0 score of 9.2 and can permit unauthenticated remote code execution. Risk and exploitability differ by configuration; the PHP project considers mod_php particularly exposed. See the official PHP security release announcement for current guidance.

The vulnerabilities stem from how PHP handles out-of-memory errors and request states:

• 🧠 CVE-2026-109618: Corrupts memory during out-of-memory (OOM) handling, treating partially initialized internal request data as valid.
• 👻 CVE-2026-109619: A use-after-free flaw where request-owned internal state survives after its backing memory has been freed.

🏛️ CISA and the UK’s NCSC strongly urge organizations to immediately apply patches (versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35). The NCSC advises that systems running unsupported, end-of-life versions (PHP 8.1 and earlier) must be taken offline if they cannot be updated.

🚨 NSA Warning: The National Security Agency (NSA) has issued an urgent advisory echoing this guidance, warning that these vulnerabilities often provide a direct path to the server’s file system or database. Their directive is clear: “If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.”

Read the Full NSA Advisory Here

🏢 What This Means for the Broadcom / VMware Portfolio

Broadcom product status: The entries below reflect the product-specific assessments cited in the linked Broadcom knowledge base articles. Products assessed as Not Vulnerable should be described plainly as such; an unrelated PHP workload running on the same infrastructure is a separate assessment.

• ✅ VMware Cloud Foundation (VCF) & VMware vSphere Foundation (VVF): NOT VULNERABLE. Broadcom’s KB 459989 identifies VCF components as not vulnerable because they do not use PHP. This confirmation explicitly extends to the underlying core virtualization stack—including VMware vSphere, vCenter Server, and ESX/ESXi (versions 8.x and earlier)—which do not utilize PHP and are completely unaffected. Follow product-specific guidance for any separately installed add-on components.
• ✅ Avi (Advanced Load Balancer): NOT AFFECTED. Broadcom KB 460068 confirms the appliance itself does not utilize PHP. This status is distinct from PHP-based applications protected or load-balanced by Avi, which still require their own PHP updates.
• 🟢 Bitnami PHP images: Confirm the exact image tag, digest and published fix status before declaring an installation remediated. Rebuild and redeploy affected containers with patched PHP images; updating a registry image does not update running containers automatically.
• 🟢 Tanzu Application Service (Cloud Foundry): Resolved. The Tanzu PHP Buildpack v5.0.9 has been released to address these vulnerabilities. Admins must upgrade to v5.0.9 and restage applications to apply the fix.

🛑 Immediate Action Plan: Patch PHP First, WAF as Defense in Depth

Critical mitigation clarification (October 21, 2026): The PHP security team explicitly states there are no complete workarounds for these vulnerabilities; patching or upgrading PHP is required. WAF rules, IP reputation, rate limits and restricted upload handling can offer partial defense-in-depth, but they must never be presented as equivalent to a patched PHP runtime. This distinction is particularly important because exploit requests may be processed by PHP before application-level authentication or security checks. See the PHP project announcement and Cloudflare’s response analysis.

For organizations running downstream PHP workloads, review any vendor-confirmed Avi WAF coverage as a temporary additional control while deploying fixed PHP versions. Refer to Broadcom KB 460068 for the official WAF implementation guidance and supported signatures. Do not assume a generic Core Rule Set or an individual rule provides complete PHP2Shell coverage. Confirm applicability, parser behavior, inspection limits and false-positive impact in your own deployment.

1. 🛡️ Enable Avi CRS & IP Reputation: Ensure Default CRS rules 920170, 920180, 920370, 920380, 932100–932200, and 933100–933190 are in enforcement mode to block known payloads, and activate IP reputation.
2. 🎯 Apply Pre-CRS Signatures: Implement custom WAF rules to block specific exploit vectors, such as PHPSESSID in POST requests, unsafe characters in PHP_SESSION_UPLOAD_PROGRESS, and PHP open tags or serialized objects in upload filenames.
3. 🔍 Inventory & Isolate: Following CISA guidance and NCSC recommendations, strictly identify all PHP instances (including containerized php-fpm deployments) and aggressively isolate or take offline any legacy systems that cannot be patched.

🛡️ vDefend Distributed IDS/IPS (East-West Virtual Patching)

For organizations running older, unpatched PHP workloads deep in the data center, VMware vDefend (NSX Distributed Firewall with ATP) provides immediate lateral protection. By leveraging the Security Services Platform (SSP) and NSX IDS/IPS, admins can apply “virtual patching” directly at the hypervisor vNIC.

• Targeted Enforcement: Create a Security Profile targeting your specific PHP web server groups (Steps 1 & 2 in the workflow below).
• Active Threat Dropping: The latest vDefend threat intelligence feeds include specific signatures to detect and drop CVE-2026-109618 exploitation attempts (such as malicious PHP_SESSION_UPLOAD_PROGRESS payloads) before they ever reach the guest OS (Steps 3 & 4).

📢 Update note (October 21, 2026): Individual Broadcom product assessments can change as investigations conclude. Re-check the linked vendor KBs and your product’s support advisories before making an upgrade or exposure decision. This article is a dated status snapshot, not a continuously updated vulnerability database.

---

📢 Update & Addendum: Broadcom Product Assessment & Official KBs

Broadcom product-specific assessment (October 21, 2026): The status shown below follows the linked Broadcom KB assessments. Not Vulnerable means the identified product is not vulnerable to these two PHP CVEs; it does not mean that unrelated customer-hosted PHP applications have been patched. Under Investigation is shown only where the applicable product assessment has not concluded. Consult the linked KB for its exact product/version scope and any later revision.

⚠️ Material status change — October 22, 2026, 08:00 Pacific: Broadcom ESG advisory 39404 now explicitly identifies Carbon Black App Control Server as Affected by PHP2Shell; the previous Under Investigation classification is superseded. Broadcom links a dedicated advisory 39411. KB 459982 provides updated-PHP App Control Server builds 8.12.2 and 8.13.2 for download. Customers on 8.12 or earlier may choose either; customers on 8.13 must upgrade directly to 8.13.2, following Broadcom’s linked upgrade instructions. The Carbon Black App Control Agent remains Not Vulnerable, as do other products explicitly designated Not Vulnerable in their respective KBs.

October 21, 2026 — Broadcom Enterprise Security Bulletin

Broadcom published a PHP2Shell protection bulletin stating that no Broadcom Enterprise Security Group products are confirmed affected at this time. The bulletin noted that additional product protections were in development. October 22 correction: This October 21 portfolio-level statement has been superseded for Carbon Black App Control Server: Broadcom advisory 39404 now explicitly classifies that server as Affected as of 08:00 PT October 22. KB 459982 provides updated-PHP builds. Products independently classified Not Vulnerable remain so, including Carbon Black App Control Agent.

Upstream PHP guidance: The PHP project’s October 21 security advisory includes temporary exposure-reduction measures for specific attack paths, such as disabling session upload progress and restarting workers. It explicitly cautions that these measures are incomplete; installing a fixed PHP version or a vendor-confirmed backport remains the required remediation for affected PHP runtimes. These PHP workload precautions do not alter Broadcom’s Not Vulnerable product assessments.

October 22 Review — Additional Broadcom Product Assessments (Advisories Issued October 21)

Brocade: Confirmed Not Affected. Broadcom’s Brocade security advisory BSA-2026-4115 (notification 39406) explicitly lists Brocade Fabric OS, Brocade ASCG, and Brocade SANnav as Products Confirmed Not Affected by CVE-2026-109618 and CVE-2026-109619, with the reason given as Component_not_present. These are vendor product determinations, not statements about unrelated PHP workloads.

Enterprise Security Group: Updated October 22 at 08:00 PT. Broadcom’s ESG advisory 39404 now lists Carbon Black App Control Server as Affected and links advisory 39411. Symantec Endpoint Protection Manager (SEPM) is Affected under Broadcom’s updated October 22 advisory, with a dedicated product advisory 39421. CloudSOC CASB and Content Analysis remain Under Investigation. This SEPM determination applies to the Manager, not to the separately listed Symantec Endpoint Protection (SEP) Agent, which remains Not Vulnerable. Separately, the advisory lists Carbon Black App Control Agent, Carbon Black EDR Server and Sensor, Carbon Black Cloud Platform and Sensor, Cloud SWG, DLP, SEP Agent, and Symantec Endpoint Security as Not Vulnerable. See the linked advisory for the complete product list and scope. The server and agent classifications must not be conflated.

Review date: October 22, 2026. Brocade advisory 39406 was issued October 21. ESG advisory 39404 was updated October 22, changing Carbon Black App Control Server and Symantec Endpoint Protection Manager (SEPM) from Under Investigation to Affected. Broadcom links dedicated SEPM advisory 39421 for product-specific remediation details. No reversal of the listed VCF, VIP, CA Advanced Authentication, IDSP, Avi, Brocade, or other expressly Not Vulnerable/Not Affected determinations is asserted. The PHP project continues to recommend installing fixed PHP runtimes for affected workloads.

October 22 Update: AWS Reports Pre-Disclosure PHP2Shell Attempts

Amazon Threat Intelligence reports observing a PHP2Shell exploitation attempt on October 17, 2026, before public disclosure, followed by additional activity on October 21. AWS cautions that the observed attempts do not establish successful compromise of real-world systems. For affected PHP workloads, AWS recommends reviewing logs from at least October 17 and applying the fixed PHP releases. This threat activity does not alter Broadcom product-specific Not Vulnerable, Not Affected, or Under Investigation classifications. Source: AWS Security Blog, October 21, 2026.

October 22 Update: Broadcom Publishes PHP2Shell Detection and Hunting Guidance

Broadcom’s Symantec and Carbon Black Threat Hunter Team analysis, published October 22, 2026, documents additional defensive detection and hunting options for customers operating PHP workloads. These are security controls protecting against malicious activity; they do not imply that the security products themselves are vulnerable, nor do they replace updating affected PHP runtimes.

• Symantec Endpoint: Broadcom reports 16 SONAR behavioral signatures related to suspicious execution and system changes, plus the file-based detection name Hacktool.Php2shell.
• Carbon Black App Control: Broadcom provides four execution-control rule patterns to identify suspicious PHP or web-server child processes and command lines on Linux and Windows. Start in Report mode, investigate alerts and test before enabling Block mode.
• Carbon Black Cloud and On-Prem EDR: Broadcom provides hunting/watchlist queries for PHP processes spawning shells, interpreters and download tools. Review potentially exposed PHP hosts from at least October 20; the AWS report also documents an observed attempt on October 17.

Consult Broadcom’s PHP2Shell Protection Bulletin for current signature names, query syntax and product coverage. Product impact status remains separate: the October 22 ESG advisory 39404 classifies Carbon Black App Control Server as Affected, while Carbon Black App Control Agent is Not Vulnerable.

Official Sources and Verification Checklist

• PHP project security releases and supported fixed versions — authoritative upstream patch guidance
• NSA advisory of October 21, 2026 — federal risk guidance
• Netherlands NCSC operational tracking repository — dated information on affected deployments and mitigation limitations
• VMware Security Blog: Neutralizing PHP2Shell with vDefend and Avi WAF — Official VMware guidance on applying virtual patching and lateral security to block CVE-2026-109618 exploitation
• Cloudflare’s PHP2Shell WAF response — a defense-in-depth example, not a replacement for upgrading PHP

Priority: Inventory each public-facing PHP runtime, confirm whether it is running an affected release, install vendor-fixed PHP or distributor-confirmed backported packages, restart affected workers, validate the deployed web-serving runtime (not just CLI PHP), and check software inventories for bundled PHP. Unsupported branches need vendor-supported migration or isolation.

#PHP2Shell #CVE2026109618 #CVE2026109619 #CyberSecurity #InfoSec #Broadcom #VMware #VCF #VVF #AviWAF #Tanzu #Bitnami #VulnerabilityManagement #PatchNow