Product Notice: SonicWall Products and PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619
Overview
- CVE-2026-109618: PHP vulnerability – CVSS v4.0 Score: 9.2 (Critical)
- CVE-2026-109619: PHP vulnerability – CVSS v4.0 Score: 9.2 (Critical)
Two critical PHP vulnerabilities have been published, with potential remote code execution reported publicly. SonicWall is aware of customer inquiries and vulnerability-scanner findings related to these CVEs.
Product Impact
The SonicWall Product Security Incident Response Team (PSIRT) performed an initial review and found no use of PHP in the following products. Based on this review, SonicWall has no indication that these CVEs apply to them.
- SonicOS (firewalls)
- SMA 1000 Series
- Network Security Manager (NSM)
- Licensing and asset/account management - MySonicWall
- Email Security (ES)
- Cloud Secure Edge (CSE)
- Unified Management (UM)
- Wireless Network Manager (WNM)
This is the current assessment and is not a statement covering the entire SonicWall portfolio. SonicWall will update this notice if the assessment changes.
SonicWall Protections
|
SIGNATURE ID |
SIGNATURE NAME |
|
IPS: 22573 |
PHP Zend Memory Manager Remote Code Execution (CVE-2026-109618) 4 |
|
IPS: 22565 |
HTTP Request with PHP_SESSION_UPLOAD_PROGRESS Object (CVE-2026-109619) |
|
IPS: 22566 |
PHP Session Stale Global State Use-After-Free (CVE-2026-109619) |
|
IPS: 4636 |
PHP Warning Message (Suspicious Session ID) |
For more details and technical overview, please click PHP2Shell RCE is proven on PHP 8.5.11.
Scanner Findings
If a vulnerability scanner reports either CVE against one of the products listed above, please open a support case and provide the scanner report and relevant details. SonicWall will review each finding.
Related Information
Change Log:
- 2026-10-22 4:30 AM PDT: Initial publish.
- 2026-10-22 7:25 AM PDT: Updated Product Impact list to add Switches and Access Points (SonicWave).
- 2026-10-22 8:17 AM PDT: Updated Product Impact list to remove Switches and Access Points (SonicWave) and add Unified Management (UM) and Wireless Network Manager (WNM). SonicWall PSIRT is currently evaluating Switches and Access Points (SonicWave) for impact from the PHP vulnerabilities.
- 2026-10-22 12:50 AM: Added SonicWall Protections section with IPS signatures for CVE-2026-109618 and CVE-2026-109619, and added the PHP2Shell RCE blog link to Related Information.