VMware Avi Load Balancer - Mitigation for CVE-2026-109618 and CVE-2026-109619
Article ID: 460068
Updated On:
Products
Issue/Introduction
On October 21, 2026, PHP disclosed the following vulnerabilities, deemed PHP2Shell:
- CVE-2026-109618 – Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat invalid data as valid.
- CVE-2026-109619 – Request-owned internal state can persist after its backing memory has been freed. A subsequent request handled by the same worker may access this stale state before initialization resets it.
VMware Avi Load Balancer is not affected by these vulnerabilities. Avi Load Balancer does not use PHP packages. All VMware Avi Load Balancer components including Avi Controller, Avi Service Engine and Avi Operations remain unaffected.
Environment
Customer workloads using a vulnerable version of the PHP package
Resolution
To protect PHP-based applications with Avi WAF, perform the following actions:
Step 1: Enable Default CRS Rules
Ensure the following rules are enabled in Enforcement mode:
- Rules 920170 & 920180 (Multipart Request Anomalies): Restrict malformed multipart payloads, boundary mismatches, and data truncation used to trick the PHP engine during parsing.
- 920170 – GET or HEAD Request with Body Content
- 920180 – POST Request without Content-Length Header
- Rules 920370 & 920380 (Too Many Headers / Argument Limits): Limit total request headers and body parameters to prevent attackers from sending excessive variables to trigger an out-of-memory condition.
- 920370 – Enforce maximal length of argument values
- 920380 – Enforce maximal number of arguments
- Rules 932100–932200 (Remote Command Execution): Inspect outbound OS command injection payloads (e.g., executing /bin/sh or spawning interactive shell commands) if an attacker attempts memory corruption exploits.
- Rules 933100–933190 (PHP Application Attacks): Inspect incoming requests (URLs, headers, and form data) for malicious PHP code payloads to block injection attempts.
Step 2: Configure CVE-specific pre-CRS Rules
Once the above rules are in place, proceed to add the following custom pre-CRS rules:
| Rule Number | Rule Content |
| 1 | SecRule REQUEST_METHOD "@streq POST" "id:200, phase:2, deny, status:403, t:none, tag:'CVE-2026-109618', tag:'CVE-2026-109619', msg:'PHP2Shell: PHPSESSID submitted as POST form field (session fixation)', severity:'CRITICAL', chain" |
| 2 | SecRule REQUEST_METHOD "@streq POST" "id:201, phase:2, deny, status:403, t:none, tag:'CVE-2026-109618', tag:'CVE-2026-109619', msg:'PHP2Shell: PHP_SESSION_UPLOAD_PROGRESS value contains unsafe characters', severity:'CRITICAL', chain" |
| 3 | SecRule FILES "@rx <\?(?:php|=)" "id:202, phase:2, deny, status:403, t:none, t:lowercase, tag:'CVE-2026-109618', msg:'PHP2Shell: PHP open tag in upload filename', severity:'CRITICAL'" |
4 | |
To add a Pre-CRS rule, follow the steps below:
On the Avi Controller UI navigate to WAF policy > Signatures
Under Signatures , go to Pre-CRS Groups and click Add
Enter Name and Click Add under Rules
On the Create Pre-CRS Rule screen, add the rules (shown above) and set the Rule mode to Enforcement to actively block the exploit
- Click Save
Additional Features
- IP Reputation: Block traffic from known malicious IP addresses by enabling the Avi IP Reputation service.
Additional Information
For any questions or further technical assistance, please reach out to the Avi Load Balancer Support team through the Broadcom support portal.
This Knowledge Base will be updated with more information as additional information is available.
References
- https://www.php.net/archive/2026.php#2026-10-21-5
- https://nvd.nist.gov/vuln/detail/cve-2026-109618
- https://nvd.nist.gov/vuln/detail/cve-2026-109619
Revision History
Version | Date | Remarks |
1.0 | 22-Oct-2026 | Initial version |
Feedback
