What Happened: Cisco PHP Vulnerability
The Cisco PHP vulnerability, CVE-2026-109618 and CVE-2026-109619, is critical and public. For an MSP, this is unplanned client downtime, emergency patching, and a recovery you did not schedule. Patch affected assets immediately.
On October 21, 2026, the PHP Foundation announced a critical PHP security release addressing two remote code execution flaws. On October 30, 2026, Cisco published a security advisory for vulnerabilities in PHP affecting Cisco products and rated the security impact as Critical. CERT-EU says technical details are now being discussed publicly, and initial proofs of concept have begun to circulate. That raises the likelihood that attackers are already exploiting the vulnerabilities. CERT-EU advises organizations to patch affected assets immediately.
The two flaws are tracked as CVE-2026-109618, RCE via OOM corruption, and CVE-2026-109619, RCE via stale global state. Together they are being referenced as PHP2shell.
Separately, CERT-EU reports that on October 23 PHP disclosed a new RCE vulnerability. It affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. PHP will not issue an out-of-band release for it.
Timeline
- On 20 October 2026, the PHP project announced an upcoming security release addressing two critical vulnerabilities in PHP.
- On 21 October 2026 at 13:30 UTC, the PHP team released fixes in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- On 23 October, PHP disclosed a new RCE vulnerability that affects only web applications configured in an unusual way.
- On October 30, 2026, Cisco published a security advisory for critical PHP vulnerabilities affecting its products, with a security impact rating of Critical.
Who Is Affected
Any environment running a PHP version that has not been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 is exposed. Cisco products listed in the advisory are affected. Cisco states that if a product is not listed within the advisory, its review indicates that the product is not affected by this vulnerability.
Internet-facing applications are the main concern because both vulnerabilities can allow unauthenticated remote code execution. An attacker who compromises one of these applications can end up inside the client environment.
Technical Details
CVE-2026-109618 is remote code execution via OOM corruption. CVE-2026-109619 is remote code execution via stale global state. The vulnerabilities affect PHP and are collectively referenced as PHP2shell.
Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both vulnerabilities can allow unauthenticated remote code execution. Cisco rates the security impact as Critical.
The PHP Foundation advisories are GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. Cisco's advisory will be updated as additional information becomes available.
Why This Matters for MSPs
An RCE flaw in a component like PHP matters because PHP is widely used in web applications. When a client runs an unpatched version, the MSP is the one who gets the call after the damage is done. The work includes confirming the scope, restoring systems, and explaining to the client what happened.
A patch release is not the end of the job. You have to know which client environments run PHP, which Cisco products are affected, and whether the fix has actually been applied. That is normal patching work, but the Critical rating makes it urgent.
Patching is the direct fix. A compromised internet-facing application can mean a client is down, data is being restored, and other client work is put on hold.
What MSPs Should Do
Patch first. The fixes are out, and the priority is to get them onto every affected system.
- Patch affected assets immediately with PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Where patching is not feasible, isolate internet-facing applications from public networks until a fix is applied and verified.
- Check Cisco's advisory for the full list of affected products, and verify whether any of your clients run one of them.
- Confirm the patched PHP version is actually running after the update.
- After patching, run a quick smoke test on the application to confirm it still works.
- Monitor the Cisco advisory and CERT-EU advisory for updates, because the Cisco advisory will be updated as additional information becomes available.
- As a standing practice, keep an inventory of every internet-facing application that depends on PHP.
How EnterProtect Helps
EnterProtect backup keeps clean restorable copies of client data and systems. If a compromised application forces a rebuild, recovery can get a client running again from a known good point.
EnterProtect vulnerability scanning gives you visibility into the software versions running on client systems, which supports patching decisions.
EnterProtect does not replace patching. It supports the response after the fact and the planning before it.
Frequently Asked Questions
What Are CVE-2026-109618 and CVE-2026-109619?
They are two critical PHP vulnerabilities announced by the PHP Foundation on October 21, 2026. CVE-2026-109618 is remote code execution via OOM corruption, and CVE-2026-109619 is remote code execution via stale global state. Together they are referenced as PHP2shell.
Which PHP Versions Fix These Vulnerabilities?
The fixes were released in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026. Apply the appropriate version to every affected system. Where patching is not feasible, isolate internet-facing applications from public networks until a fix is applied and verified.
Are Cisco Products Affected by These PHP Vulnerabilities?
Cisco published a security advisory on October 30, 2026, rating the security impact as Critical. Cisco states that products not listed in the advisory are not affected by this vulnerability. Check the advisory for the specific product list.
What Is PHP2shell?
PHP2shell is the name being used for the two critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution.
How Urgent Is Patching?
CERT-EU advises patching affected assets immediately. Technical details are being discussed publicly, and initial proofs of concept have begun to circulate, which raises the likelihood that attackers are already exploiting the vulnerabilities.
What Should I Do If I Cannot Patch Right Away?
Isolate internet-facing applications from public networks until a fix is applied and verified. That reduces exposure while you prepare the update. Treat this as a temporary measure, not a replacement for patching.
Sources
- Vulnerabilities in PHP Affecting Cisco Products: October 2026 (Cisco Psirt)
- 2026-018: Critical Vulnerabilities in PHP (Cert Eu)