Summary

Broadcom's Enterprise Security Group is investigating CVE-2026-109618 and CVE-2026-109619 "PHP2Shell", which are two critical vulnerabilities in PHP.

Affected Product(s)

Carbon Black App Control Server - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39411
Symantec Endpoint Protection Manager (SEPM) - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39421
CloudSOC SpanVA Appliance - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39429

Additional Product Information

The following products are under investigation:

Content Analysis

The following products are not vulnerable:

Advanced Secure Gateway (ASG)
BCAAA
Carbon Black App Control Agent
Carbon Black Cloud CWP Appliance
Carbon Black Cloud Platform
Carbon Black Cloud Sensor
Carbon Black Cloud Sensor Gateway
Carbon Black EDR Sensor
Carbon Black EDR Server
Cloud Secure Web Gateway (Cloud SWG)
CloudSOC Cloud Access Security Broker (CASB)
Critical System Protection (CSP)
Data Center Security (DCS)
Data Loss Prevention (DLP)
Data Loss Prevention Cloud
Edge Secure Web Gateway (SWG)
HSM Agent
Information Centric Analytics (ICA)
Integrated Secure Gateway (ISG)
IT Analytics (ITA)
LiveUpdate Administrator (LUA)
Management Center (MC)
Reporter
SSL Visibility (SSLV)
Symantec Endpoint Detection and Response (EDR) On-premise
Symantec Endpoint Protection (SEP) Agent
Symantec Endpoint Protection (SEP) for Mobile
Symantec Endpoint Security (SES)
Symantec Insight for Private Clouds
Symantec Mail Security for Microsoft Exchange (SMSMSE)
Symantec Protection Engine (SPE)
Symantec Protection Engine (SPE) Console
Symantec Protection for SharePoint Servers (SPSS)
Threat Defense for Active Directory (TDAD)
Web Isolation (WI) Virtual Machine
Web Isolation (WI) Cloud Native
Zero Trust Network Access (ZTNA)

References

• PHP2Shell Security Advisories - https://nvd.nist.gov/vuln/detail/CVE-2026-109618 | https://nvd.nist.gov/vuln/detail/CVE-2026-109619

Revisions

2026-10-21 01:00 PT - Initial Release
2026-10-21 01:30 PT - Content Analysis moved to Not Vulnerable
2026-10-21 03:00 PT - Content Analysis moved to Under Investigation
2026-10-22 08:00 PT - Carbon Black App Control moved to Affected
2026-10-22 04:00 PT - Symantec Endpoint Protection Manager moved to Affected
2026-10-23 11:00 PT - CloudSOC SpanVA Appliance added to Affected and Symantec Protection Engine (SPE) Console added to Not Vulnerable
2026-10-23 12:00 PT - CloudSOC Cloud Access Security Broker (CASB) moved to Not Vulnerable