Impact Evaluation of PHP issues CVE-2026-109618 and CVE-2026-109619 of VMware by Broadcom product portfolio

Products

• VMware Cloud Foundation
• VMware Cloud Director
• VMware HCX
• VMware Telco Cloud Platform
• VMware Workstation
• VMware Fusion

Issue/Introduction

Two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been publicly disclosed by the PHP project. These vulnerabilities may allow for remote code execution without authentication.

Environment

VMware by Broadcom Products

Cause

The vulnerabilities allow to create an out-of-memory condition that may result in memory corruption. This corruption may lead to unauthenticated remote code execution.

Resolution

There are zero affected products in the VMware Cloud Foundation product line. 

For a full list of Broadcom products affected, refer to Broadcom Response to PHP2shell Vulnerabilities.