AgentMinder Identity / IDSP / VIP Auth Hub Assessment for PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

Inquiries have been raised regarding whether AgentMinder Identity (formerly Identity Security Platform / IDSP, also known as VIP Authentication Hub) is affected by the PHP remote code execution (RCE) vulnerabilities designated under CVE-2026-109618 and CVE-2026-109619.

Environment

Product: AgentMinder Identity / Identity Security Platform (IDSP) / VIP Authentication Hub

Cause

Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (commonly referred to in industry advisories as "php2shell") specifically target core runtime components of the PHP interpreter engine.

AgentMinder Identity (IDSP / VIP Authentication Hub) is built entirely on non-PHP architecture and stack components. Because the product suite does not incorporate or execute PHP runtime components in its application backend or core web framework, these vulnerabilities are not applicable to the system.

Resolution

AgentMinder Identity (IDSP / VIP Authentication Hub) is NOT vulnerable to CVE-2026-109618 or CVE-2026-109619.

No patch, configuration update, or mitigation step is required for AgentMinder Identity regarding these PHP advisories.

Additional Support

If you have any further technical questions or require additional security verification regarding your environment, please reach out directly to Broadcom Support via the Broadcom Contact Support Portal.