Vulnerabilities in PHP Affecting Cisco Products: October 2026
// summary
Two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect certain Cisco products.
// from the source
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. These vulnerabilities are being referenced as PHP2shell. For information about Splunk products and offerings, see Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-1096