Three Cisco product lines now sit in the affected column of the company’s October 22 PHP advisory: Ultra-Reliable Wireless Backhaul (URWB), Expressway Series and Expressway Select Series. Cisco is still investigating Catalyst Center, ISE Portal Builder, Meraki Dashboard and several other products. These are the PHP2shell remote-code flaws, CVE-2026-109618 and CVE-2026-109619, so Cisco operators need a product inventory as well as an upstream PHP upgrade plan.
The unexpected constraint is in the wireless entry: Cisco says exploitation of URWB requires an account authenticated as an administrator, and assigns that product a 6.6 CVSS 3.1 score. The wider advisory remains Critical. Cisco’s assessment concerns its own products; the separate PHP security releases fix the language runtime, while Cisco’s listed product releases have future dates.
Two paths through PHP request memory
PHP’s own record for CVE-2026-109618 describes an out-of-memory error that uses longjmp() to leave request handling. In certain contexts, an allocation follows with request memory in an uninitialized state, and cleanup may read or branch on it. The record says multiple out-of-memory strategies can trigger that condition and lead to remote code execution.
The record for CVE-2026-109619 describes a different request-lifetime problem. Temporary global pointers into request memory can survive after that memory has been freed; a later request can then read or branch on stale state before it is initialized. PHP credits Wiz, Ryan at Calif.io and OpenAI across the two records, with different roles for each. Both records rate the upstream flaws 9.2 under CVSS 4.0. That upstream rating and Cisco’s URWB-specific 6.6 describe different access conditions and scoring versions.
The PHP 8 changelog records both advisory fixes in 8.2.35, 8.3.36, 8.4.27 and 8.5.12, all dated October 22. Those are useful version targets for PHP instances an organization actually maintains. For Cisco appliances and services, use Cisco’s product-specific advisory and bug IDs to track the corresponding release.
Cisco’s three product lists
In the Cisco advisory, URWB maps to bug CSCwx37073 and a planned 27.1.1 release dated February 2027. Expressway Series and Expressway Select Series both map to CSCwx37062 and a 15.5.21 release with its date listed as TBD. Those are release plans in an interim advisory, so check the bug and download channel for actual availability before scheduling an upgrade.
Other entries are under investigation, including Catalyst Center, WAN Automation Engine, Unified Industrial Wireless Software, CX Cloud and IoT Control Center, as well as the products named above. Track those assets on their own watch list while Cisco investigates them. Cisco also has a confirmed not vulnerable list covering ISE itself, IOS XE, NX-OS, Secure Firewall products and Meraki MX appliances, among others. Distinguish ISE Portal Builder under investigation from ISE confirmed unaffected; likewise, Meraki Dashboard remains under investigation while Meraki device families in the unaffected list have a separate finding.
Cisco labels its workaround field “No workarounds available.” Its PSIRT says it is not aware of malicious use of the vulnerabilities described in this advisory.
Reconcile deployments with Cisco’s advisory
Export your deployed Expressway Series, Expressway Select Series and URWB inventory with the installed software release and owner, then compare each product with bugs CSCwx37062 and CSCwx37073 in the current Cisco advisory. For URWB, review who holds administrator access and constrain that access while the product release is pending. That narrows the stated administrator-access prerequisite while you track Cisco’s product fix. For Expressway, keep its separate product bug and 15.5.21 release plan with the platform owner, especially if the same team is already addressing Expressway’s separate cluster issue.
Track each under-investigation product in the advisory until Cisco moves it to an affected or unaffected list. Cisco directs customers to its product bugs for fixed releases and platform-specific guidance, and to TAC or their maintenance provider when upgrade support is unclear. Keep the advisory version and an owner beside each tracked asset, so a change in product status reaches the team responsible for its update. When Cisco publishes a product fix, verify the installed build against its bug entry. If your team also runs PHP directly, verify those servers against the four October 22 PHP versions above; that runtime check answers a different ownership question from the Cisco appliance inventory.