Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Splunk Products - October 2026

Advisory ID: SVD-2026-1013

Published: 2026-10-22

Last Updated: 2026-10-22

Description

On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities:

  • CVE-2026-109618 - RCE via OOM corruption
  • CVE-2026-109619 - RCE via stale global state

For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. These vulnerabilities are being referenced as PHP2shell.

Splunk is investigating to determine which products may be affected by these vulnerabilities and the impact on each affected product. Currently, no Splunk products are known to be affected. This advisory will be updated as information is available.

Product Status

ProductStatus
Splunk Cloud PlatformUnaffected
Splunk EnterpriseUnaffected
Splunk Universal ForwarderUnaffected
Splunk Enterprise SecurityUnaffected
Splunk ITSIUnaffected
Splunk SOAR CloudUnaffected
Splunk SOARUnaffected
Splunk SOAR ConnectorsUnaffected
Splunk Observability CloudUnaffected
Splunk Observability OpenTelemetry CollectorsUnaffected
Splunk OnCallUnder Investigation
Splunk UEBAUnaffected
Splunk Apps & Add-onsUnaffected
AppDynamics SaaSUnder Investigation
AppDynamics On-PremisesUnaffected
AppDynamics PHP AgentUnaffected
GalileoUnaffected
WideFieldUnaffected
SmartlookUnder Investigation