CVE-2026-109618 / CVE-2026-109619, Broadcom Symantec Endpoint Protection Manager, Carbon Black App Control Server, CloudSOC SpanVA and Content Analysis and Malware Analysis: PHP2Shell reaches the endpoint-security management servers; App Control Server 8.12.2 and 8.13.2 are the fixes Broadcom names

Broadcom's Enterprise Security Group advisory 39404, published on 2026-10-21 and last revised on 2026-10-30, lists four products as affected by the PHP flaws CVE-2026-109618 and CVE-2026-109619: Carbon Black App Control Server (moved to affected on 2026-10-22), Symantec Endpoint Protection Manager (SEPM, 2026-10-22), the CloudSOC SpanVA Appliance (2026-10-23) and Content Analysis and Malware Analysis (CASMA), which moved from under investigation to affected on 2026-10-30; the page states no versions, fixes or workarounds, and lists Content Analysis (CAS), the Symantec Endpoint Protection agent, Symantec Endpoint Security, Data Loss Prevention, Cloud Secure Web Gateway and Zero Trust Network Access among the products that are not vulnerable (Broadcom, 2026-10-30). CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26 (CISA KEV catalog, 2026-10-26); Broadcom's advisory says nothing about attacks on these products.

Broadcom's article 459982 says the App Control Server is affected in all supported versions and that builds 8.12.2 and 8.13.2 are available and contain only PHP-related changes: an installation on 8.12 or earlier may take either, one already on 8.13 must take 8.13.2 (Broadcom, 2026-10-22). For SEPM, NCSC-NL's tracker lists builds 14.3.27716.10000 and 14.4.494.0000 as the fixes, on the strength of a community report that cites Broadcom's SEPM advisory, which needs a login and which the maintainer did not verify (NCSC-NL, 2026-10-30). No fix is stated for the CloudSOC SpanVA Appliance or CASMA.