Impact Evaluation of PHP issues CVE-2026-109618 and CVE-2026-109619 of VMware by Broadcom product portfolio

Products

• VMware Cloud Foundation

Issue/Introduction

Two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been publicly disclosed by the PHP project. These vulnerabilities may allow for remote code execution without authentication.

Environment

VCF

Cause

The vulnerabilities allow to create an out-of-memory condition that may result in memory corruption. This corruption may lead to unauthenticated remote code execution.

Resolution

VMware Cloud Foundation components do not use PHP and are not affected by the two PHP vulnerabilities.