Tanzu PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619
Article ID: 460156
Updated On:
Products
Issue/Introduction
On 10/21/26 two critical Remote Code Execution (RCE) security vulnerabilities were discovered in PHP and both rated CVSSv4 (Common Vulnerability Scoring System) 9.2. If exploited, an unauthenticated attacker could potentially execute arbitrary code on the host system.
The Tanzu division initiated the incident response process immediately upon receiving the PHP advisory. Pipelines started releasing fixes within the hour and all Tanzu and TrueSource products were fully patched by the end of the day.
The core components of Tanzu Platform and Tanzu Data Intelligence are not affected by these vulnerabilities. For all customers running PHP workloads on platform all necessary patches have been released through the PHP buildpacks and can be easily rolled out for all applications via the cf restage command.
For customers leveraging TrueSource Trusted Artifacts or Bitnami Secure Images, all PHP related images were promptly patched.
Customers who have applied the patches are not vulnerable to the PHP RCE exploits. To ensure all environments are fully protected against these vulnerabilities, customers must update their deployments to the latest patched versions immediately.
The vulnerabilities:
- CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
- CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
Vulnerable PHP versions: All versions from 5.4 through 8.5.11
Patched in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Environment
Impacted Products
- Tanzu Platform PHP Buildpack before v5.0.9
- TrueSource Trusted Artifacts (and Bitnami Secure Images):
- PHP-FPM
- PHP-FPM minimal (distroless)
- LAMP
- WordPress
- WordPress with NGINX
- WordPress Multisite
- Drupal
- Bitnami LMS powered by Moodle™ LMS
- Nextcloud
- phpMyAdmin
- Matomo
- Magento
- Tanzu Application Platform PHP Cloud Native Buildpack before v6.2.2
Resolution
- Tanzu Platform PHP Buildpack v5.0.10 contains PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 is available in the Broadcom Support Portal.
- Upgrade the PHP buildpack to v5.0.10 and restage the applications to fix the vulnerabilities.
- The PHP buildpack security fixes page will be updated shortly.
- TrueSource images for PHP were published shortly after the advisory announcement:
- Bitnami latest TrueSource images for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
- Bitnami rebuilt all the images which depended on PHP such as Wordpress, Drupal among others (see Impacted Products for complete list)
- Upgrade to the latest Truesource images from Bitnami to fix the vulnerabilities.
- Tanzu Application Platform (TAP) PHP Cloud Native Buildpack v6.2.2 contains PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 is available in the Broadcom Support Portal..
- TBS 2.x dependency updates contain the patched buildpack. Version is 200.0.40. Dependency updater users will consume automatically and apps will be rebuilt. Non dependency update users should download minimum dependency version 200.0.40 from Broadcom Support Portal.
- TAP auto dependency updater version 1.12.366 released with patched buildpack. Dependency updater users will consume automatically and apps will be rebuilt. Non dependency update users will need to consume full dependency package repo version 1.12.152 from packages.broadcom.com
Feedback
