CERT-FR advisory CERTFR-2026-AVI-1476: Cisco patches PHP2shell RCE flaws CVE-2026-109618/109619 in Expressway, Duo Access Gateway, ISE and URWB

Entenda a falha

A vulnerabilidade

Two critical flaws in PHP, nicknamed PHP2shell, affect Cisco products that ship a vulnerable PHP build. CVE-2026-109618 is remote code execution through out-of-memory corruption. CVE-2026-109619 is remote code execution through stale global state. Both reportedly need no authentication or user interaction. Third-party trackers give CVSS 4.0 of 9.2 and NVD-style scores of 9.8 and 8.1. Affected: Duo Access Gateway before 3.2.0, Expressway and Expressway Select before 15.5.21, ISE Portal Builder, and URWB and Unified Industrial Wireless before 26.2.1.9 (fix expected November 2026). Cisco bug CSCwx37062 says Expressway is affected in its default configuration. Cisco says products not listed are not affected.

Como funciona

A request reaches a PHP worker inside the Cisco product. For CVE-2026-109618, when memory runs out during request handling, PHP uses longjmp() to abort the request. That leaves some internal structures only partly initialised, and the later cleanup reads or branches on corrupted memory. For CVE-2026-109619, a fatal error leaves global state behind, and a worker can still reference it when it handles a later request. In both cases the process then works with memory or state it should not trust, and that can lead to execution of attacker-controlled code.

Por que é vulnerável

The root cause is unsafe error handling in PHP. Aborting with longjmp() on out-of-memory skips normal initialisation and cleanup, so later code assumes structures are consistent when they are not. Likewise, global state is not reset after a fatal error, so a later request inherits stale data. The articles do not say why this went unnoticed. The fix is delivered through patched PHP releases, which Cisco bundles into its product updates.

Onde está

Upstream, the issues are tracked as GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp in php/php-src; the articles name no file or function beyond longjmp() usage.

Como foi descoberta

The PHP Foundation disclosed the flaws on 21 October 2026, and researchers named them PHP2shell. CISA added both CVEs to its KEV catalog on 26 October with a 29 October due date. Cisco published advisory cisco-sa-php-october26-Jj384Daq on 30 October, and CERT-FR relayed it on 6 November as CERTFR-2026-AVI-1476. The story says the upstream flaws are exploited in the wild, but Cisco PSIRT states it is not aware of malicious use against any Cisco product. The articles do not say who found the bugs.

Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 11:26.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

   PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

   This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

   CVE-2026-109618 · autor: OffSec · explicação gerada por IA

Detalhes técnicos

Remediação