App Control PHP2Shell Impact - CVE-2026-109618 and CVE-2026-109619

Products

• Carbon Black App Control

Issue/Introduction

Is the App Control Server impacted by PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619?

Environment

• App Control Server: All Supported Versions

Resolution

See Carbon Black App Control Server Security Update and Action Required - Update Carbon Black App Control to Address PHP2Shell Vulnerabilities.

App Control Server builds 8.12.2 and 8.13.2 are now available for download. These releases exclusively contain PHP-related changes. Please refer to the Upgrading the App Control Server documentation for installation instructions.

Additional Information

• If you are currently on version 8.12 or earlier, you may choose to upgrade to either 8.12.2 or 8.13.2. However, users already on version 8.13 must upgrade directly to 8.13.2.
• For information on other Broadcom Enterprise Security Group products, see Enterprise Security Group Advisory for PHP2Shell