PHP2Shell Security Advisory CVE-2026-109618 CVE-2026-109619 - Security Advisory TWA SEC 3662

TCPWave DDI & ADC Solutions

On 21 October 2026, the PHP project released emergency fixes for two critical core PHP remote code execution vulnerabilities, collectively known as PHP2Shell. The issues can be reached by unauthenticated web requests when a vulnerable PHP runtime serves requests. TCPWave IPAM and Remote products in the version scope below do not use PHP to serve their application requests and are not affected by these CVEs.

CVE-2026-109618 concerns out-of-memory handling that can leave request memory in an invalid state. CVE-2026-109619 concerns stale global state that can be reused across requests. PHP lists each as Critical with a CVSS v4.0 score of 9.2. PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain the security fixes; the PHP project issued an additional session upload progress advisory on 23 October 2026.

The vulnerable component is PHP itself. TCPWave's product assessment states that PHP is absent from the IPAM and Remote application stack across all 11.32 and 11.33 releases and through the latest assessed 11.34 P2 C18 release.

TCPWave IPAM and Remote products:

• All versions of 11.32
• All versions of 11.33
• Version 11.34 through P2 C18

Status: Not Affected.

No mitigation is required for the assessed TCPWave IPAM or Remote products because the vulnerable PHP runtime is not included in the product application stack. No configuration change, service interruption, or appliance reboot is required for PHP2Shell.

If an organization has independently installed PHP on an appliance or placed a separate PHP application on the same server, that installation is outside this product assessment. Inventory that deployment and apply the PHP project's current security guidance to it.

No TCPWave IPAM or Remote hotfix is required for CVE-2026-109618 or CVE-2026-109619 within the assessed version scope: all 11.32 versions, all 11.33 versions, and all 11.34 versions through 11.34 P2 C18. TCPWave will continue to review third-party component advisories as part of its normal security process.

For any clarifications or assistance about this assessment, please contact TCPWave Technical Support: [email protected].