Summary

Broadcom's Enterprise Security Group is investigating CVE-2026-109618 and CVE-2026-109619 "PHP2Shell", which are two critical vulnerabilities in PHP.

Affected Product(s)

No Broadcom Enterprise Security Group products are confirmed affected at this time.

Additional Product Information

The following products are under investigation:

CloudSOC Cloud Access Security Broker (CASB)
Symantec Endpoint Protection Manager (SEPM)
Carbon Black App Control Server
Content Analysis

The following products are not vulnerable:

Advanced Secure Gateway (ASG)
BCAAA
Carbon Black App Control Agent
Carbon Black Cloud CWP Appliance
Carbon Black Cloud Platform
Carbon Black Cloud Sensor
Carbon Black Cloud Sensor Gateway
Carbon Black EDR Sensor
Carbon Black EDR Server
Cloud Secure Web Gateway (Cloud SWG)
Critical System Protection (CSP)
Data Center Security (DCS)
Data Loss Prevention (DLP)
Data Loss Prevention Cloud
Edge Secure Web Gateway (SWG)
HSM Agent
Information Centric Analytics (ICA)
Integrated Secure Gateway (ISG)
IT Analytics (ITA)
LiveUpdate Administrator (LUA)
Management Center (MC)
Reporter
SSL Visibility (SSLV)
Symantec Endpoint Detection and Response (EDR) On-premise
Symantec Endpoint Protection (SEP) Agent
Symantec Endpoint Protection (SEP) for Mobile
Symantec Endpoint Security (SES)
Symantec Insight for Private Clouds
Symantec Mail Security for Microsoft Exchange (SMSMSE)
Symantec Protection Engine (SPE)
Symantec Protection for SharePoint Servers (SPSS)
Threat Defense for Active Directory (TDAD)
Web Isolation (WI) Virtual Machine
Web Isolation (WI) Cloud Native
Zero Trust Network Access (ZTNA)

References

• PHP2Shell Security Advisories - https://nvd.nist.gov/vuln/detail/CVE-2026-109618 | https://nvd.nist.gov/vuln/detail/CVE-2026-109619

Revisions

2026-10-21 01:00 PT - Initial Release
2026-10-21 01:30 PT - Content Analysis moved to Not Vulnerable
2026-10-21 03:00 PT - Content Analysis moved to Under Investigation