1-minute read
What a defender needs to know
Cisco’s October 22 interim advisory lists Ultra-Reliable Wireless Backhaul (URWB), Expressway Series and Expressway Select Series as affected in its review of PHP2shell, the remote-code flaws CVE-2026-109618 and CVE-2026-109619. URWB exploitation requires an authenticated administrator, according to Cisco. Catalyst Center, ISE Portal Builder and Meraki Dashboard are among products still under investigation; ISE itself and Meraki MX appliances are among those confirmed unaffected.
The PHP changelog marks 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as fixing both flaws in the upstream runtime. Cisco instead maps URWB to bug CSCwx37073 with a planned 27.1.1 release in February 2027; Expressway and Expressway Select map to CSCwx37062 with a planned 15.5.21 release dated TBD. Cisco lists no workaround, and its PSIRT is not aware of malicious use under this advisory.
Export the installed builds for those three Cisco lines and keep the two Cisco bug IDs with their owners. Review and restrict URWB administrator access while its release is pending. Track under-investigation assets against Cisco’s changing product lists. Keep an owner and the advisory version with each asset so that a change in status reaches its maintainer. Check each eventual installed build against the product bug before treating an upgrade as complete. For PHP servers your team manages directly, verify installed runtime versions separately against the October 22 fixes.