Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Splunk Products - October 2026
Advisory ID: SVD-2026-1013
Published: 2026-10-22
Last Updated: 2026-10-26
Description
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities:
- CVE-2026-109618 - RCE via OOM corruption
- CVE-2026-109619 - RCE via stale global state
For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. These vulnerabilities are being referenced as PHP2shell.
Splunk investigated and determined which products were affected by these vulnerabilities. If a product is not listed within this advisory, the product is not affected.
Product Status
| Product | Status |
|---|---|
| Splunk Cloud Platform | Unaffected |
| Splunk Enterprise | Unaffected |
| Splunk Universal Forwarder | Unaffected |
| Splunk Enterprise Security | Unaffected |
| Splunk ITSI | Unaffected |
| Splunk SOAR Cloud | Unaffected |
| Splunk SOAR | Unaffected |
| Splunk SOAR Connectors | Unaffected |
| Splunk UBA | Unaffected |
| Splunk Attack Analyzer | Unaffected |
| Splunk Observability Cloud | Unaffected |
| Splunk Observability OpenTelemetry Collectors | Unaffected |
| Splunk On-Call | Unaffected |
| Splunk Apps & Add-ons | Unaffected |
| AppDynamics SaaS | Unaffected |
| AppDynamics On-Premises | Unaffected |
| AppDynamics Agents | Unaffected |
| AppDynamics PHP Agent | Unaffected |
| Galileo | Unaffected |
| WideField | Unaffected |
| Smartlook | Remedied |
| Cisco Secure Endpoint - Cloud (including the Orbital component) | Unaffected |
| Cisco Secure Endpoint - Private Cloud | Unaffected |
| Cisco Secure Malware Analytics - Cloud | Unaffected |
| Cisco Secure Malware Analytics - Private Cloud | Unaffected |
| Cisco XDR | Unaffected |
The AppDynamics PHP Agent injects Splunk AppDynamics instrumentation into PHP applications at runtime, but does not include or install PHP. See the AppDynamics PHP Agent documentation for more information. Splunk strongly recommends that customers update their PHP installations immediately.
The Zabbix integration for Splunk On-Call runs on Zabbix but does not include or install Zabbix or PHP. Splunk strongly recommends that customers update their PHP installations immediately.
For Smartlook, Splunk remedied the CVEs by upgrading PHP to a fixed version. There is no action for Smartlook customers and Splunk has not found evidence of exploitation.
Changelog
2026-10-26: Updated the Description. Updated Smartlook to remedied.
2026-10-23: Added Cisco Secure Endpoint - Cloud (including the Orbital component), Cisco Secure Endpoint - Private Cloud, Cisco Secure Malware Analytics - Cloud, Cisco Secure Malware Analytics - Private Cloud, and Cisco XDR as unaffected
2026-10-23: Added information and documentation links clarifying that the AppDynamics PHP Agent and the Zabbix integration for Splunk On-Call do not include or install PHP.
2026-10-23: Updated Splunk On-Call and AppDynamics SaaS to unaffected.
2026-10-23: Added Splunk UBA and Splunk Attack Analyzer to Product Status as Unaffected.