--- title: "CVE-2026-109618 (PHP2Shell): KEV-Listed, Hits Cisco Expressway" description: PHP2Shell (CVE-2026-109618, CVE-2026-109619) is now CISA KEV-listed. Cisco confirms Expressway and Duo Access Gateway affected. What to patch now. image: https://blog.openvpn.net/hubfs/blog-headers/php2shell-cve-2026-109618-header-2500x720.png --- - [Blog](https://blog.openvpn.net) - [Cybersecurity](https://blog.openvpn.net/tag/cybersecurity) # CVE-2026-109618 (PHP2Shell): KEV-Listed, Hits Cisco Expressway Nov 13, 2026 • 5 min read ![Office building with two remote-access gateways: one compromised with a broken connection, one independent gateway with an intact connection](https://blog.openvpn.net/hubfs/blog-headers/php2shell-cve-2026-109618-header-2500x720.png) Share - - - - By Adam Bullock ## PHP2Shell went from disputed to KEV-listed in five days, and it reaches Cisco Expressway and Duo Access Gateway: here is what to patch and why your remote access needs a second, independent path. A critical PHP memory-corruption bug that was first dismissed as "just scanning" is now a confirmed, CISA-mandated emergency patch, and it reaches into VPN-adjacent gear like Cisco Expressway. CISA's federal remediation deadline of October 29, 2026 has already passed, so if you run affected systems and haven't patched, you're overdue. Here's what's confirmed, what changed, and why internet-facing management planes deserve a reduced blast radius regardless of vendor. ## CVE-2026-109618 and CVE-2026-109619: from disputed to KEV-listed The PHP Foundation disclosed two critical vulnerabilities on October 21: CVE-2026-109618, a remote code execution flaw via out-of-memory corruption, and CVE-2026-109619, an RCE via stale internal request-state, collectively nicknamed PHP2Shell. Both affect most PHP installations serving web requests. In the days that followed, Sophos and Palo Alto Networks' Unit 42 each initially reported exploitation, then retracted those claims on October 22-24 after their own telemetry showed only scanning and failed attempts rather than confirmed compromise. That changed on October 24. VulnCheck's Caitlin Condon confirmed her team got working code execution across PHP 8.2 and 8.3, rounding out testing across supported version streams, while Perplexity's Adel Karimi published honeypot evidence of successful RCE with usable memory disclosure against a PHP 8.4.26 target. Researcher Marcus Hutchins called it "the highest quality confirmation of in-the-wild php2shell exploitation" seen so far. On October 26, [CISA formally added both CVEs to its Known Exploited Vulnerabilities catalog](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog), with a federal remediation deadline of October 29, 2026, under Binding Operational Directive 26-04. ## Who is affected by CVE-2026-109618 in Cisco's product line? [Cisco's advisory (cisco-sa-php-october26-Jj384Daq)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq), as of its October 26 update, confirms a short but notable list of affected products: | **Product** | **Status** | **Fixed release** | | --- | --- | --- | | Expressway Series | Vulnerable (workaround available) | 15.5.21 | | Expressway Select Series | Vulnerable (workaround available) | 15.5.21 | | Duo Access Gateway | Vulnerable | 3.2.0 | | Ultra-Reliable Wireless Backhaul (URWB) | Vulnerable, requires authenticated admin (CVSS reduced to 6.6) | 27.1.1 (Feb 2027) | | Secure Firewall ASA | Confirmed not vulnerable | n/a | | Secure Firewall Threat Defense | Confirmed not vulnerable | n/a | | Identity Services Engine (ISE) | Confirmed not vulnerable | n/a | Expressway Series and Expressway Select are Cisco's VPN-less remote-access gateways used for mobile and remote worker connectivity, and Duo Access Gateway sits in the authentication path for remote access. Both are squarely in the remote-access category even though Cisco's core VPN firewalls (ASA/FTD) are cleared this round. Cisco notes workarounds exist for Expressway/Expressway Select; details are in the linked bug ID (CSCwx37062). The advisory states Cisco PSIRT is "not aware of any malicious use" of these CVEs against its own products specifically, even as broader PHP2Shell exploitation is now KEV-confirmed. ## Mitigation for the PHP vulnerability behind PHP2Shell - Patch PHP itself to the fixed releases referenced in the PHP Foundation's October 21 advisories (GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp) if you run PHP directly. - If you run affected Cisco products, apply the fixed releases (Expressway/Expressway Select 15.5.21, Duo Access Gateway 3.2.0) or the documented workaround in the relevant Cisco bug ID. - The federal KEV deadline of October 29, 2026 has passed. Agencies that haven't remediated are out of compliance, and every organization should treat any remaining exposure as urgent given confirmed working exploits. - Re-check any product not explicitly listed in Cisco's advisory against future revisions. Cisco revised it seven times in its first week alone. ## Reducing vendor concentration risk beyond this PHP vulnerability PHP2Shell isn't a VPN flaw, but it's a reminder of a pattern: internet-facing management and remote-access planes, whether a PHP-backed app, a VPN-less gateway like Expressway, or a traditional VPN concentrator, are high-value, high-blast-radius targets. Concentrating all remote access in one vendor's code base means one disclosure can take down your only path in. Teams re-evaluating their remote-access VPN footprint after this episode don't need a wholesale vendor swap; they need a second, independent path. [OpenVPN Access Server, a self-hosted remote access VPN](https://openvpn.net/access-server/), can run as a vendor-diverse standby layer that doesn't share Cisco's or any single vendor's code base, so a PHP2Shell-style event affecting one vendor's stack doesn't strand your whole organization. Its [zero trust application access](https://openvpn.net/access-server/features/zero-trust-app-broker/) limits users to only the resources they're allowed to reach. For teams moving toward cloud-delivered zero trust, [CloudConnexa offers a ZTNA alternative](https://openvpn.net/cloud-vpn/) that reduces reliance on exposed on-prem management planes altogether. This is about [disaster-recovery-grade business VPN redundancy](https://openvpn.net/use-cases/business-vpn/) and diversification, not replacing anyone's existing gear. ## FAQ ### Is CVE-2026-109618 being actively exploited? Yes. CISA added it to the KEV catalog on October 26, and independent researchers (VulnCheck, Perplexity's Adel Karimi) confirmed working remote code execution, following earlier retracted claims from Sophos and Palo Alto Networks' Unit 42. ### What is the CISA KEV deadline for CVE-2026-109618 and CVE-2026-109619? CISA's October 26, 2026 alert set a federal civilian remediation deadline of October 29, 2026, under Binding Operational Directive 26-04. That deadline has passed. ### Does PHP2Shell affect Cisco ASA or VPN firewalls? No. Cisco's advisory confirms Secure Firewall ASA, Secure Firewall Threat Defense, and ISE are not vulnerable. Affected products instead include Expressway Series, Expressway Select Series, Duo Access Gateway, and Ultra-Reliable Wireless Backhaul. ### What should I patch if I run Cisco Expressway? Cisco lists fixed release 15.5.21 for Expressway Series and Expressway Select Series, and notes a workaround is available (see Cisco bug CSCwx37062) if you cannot patch immediately. ### Is this the same as earlier PHP2Shell exploitation reports from Sophos and Palo Alto Networks? No. Sophos (Oct 22) and Unit 42 (Oct 24) both initially reported exploitation and then retracted those specific claims, citing only scanning and failed attempts. The confirmed exploitation that led to the KEV listing came from VulnCheck and Perplexity's honeypot research on October 24. ## Add an independent remote-access path Run OpenVPN Access Server as a vendor-diverse standby so one vendor's disclosure never takes down your only way in. Start free with two connections. [Try Access Server](https://openvpn.net/access-server/) ![Adam Bullock](https://blog.openvpn.net/hs-fs/hubfs/adamheadshot.jpg?width=300&height=300&name=adamheadshot.jpg) [Adam Bullock](https://blog.openvpn.net/author/adam-bullock) Adam has loved tech since the days of the dial-up modem. Read his perspective on the OpenVPN blog. ## Related posts from OpenVPN ### Subscribe for Blog Updates ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Adam Bullock", "url" : "https://blog.openvpn.net/author/adam-bullock" }, "dateModified" : "2026-11-13T17:48:55.290Z", "datePublished" : "2026-11-13T17:48:55.000Z", "headline" : "CVE-2026-109618 (PHP2Shell): KEV-Listed, Hits Cisco Expressway", "image" : [ "https://blog.openvpn.net/hubfs/blog-headers/php2shell-cve-2026-109618-header-2500x720.png" ], "mainEntityOfPage" : { "@id" : "https://blog.openvpn.net/cve-2026-109618-php2shell-kev-cisco-expressway", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.openvpn.net/hubfs/Dark=True%20Medium.png" }, "name" : "OpenVPN" } } ```