Oracle’s revision 2 to its PHP2Shell security advisory added Oracle Secure Backup versions 19.1.0.0.0–19.1.0.1.0 on October 26, 2026. The revised list names ten product entries: eight Oracle Communications families, Oracle Solaris 11, and Oracle Secure Backup. Administrators checking their systems should include that Secure Backup version range in their review.
INCIBE-CERT published alert INCIBE-2026-790 on October 26 and assigned it importance level 5, “Critical.” At publication, the alert marked known exploitation as “No” and noted that the status could change.
Products and versions in Oracle’s revised advisory
Oracle lists these affected product versions in revision 2:
| Oracle product | Versions listed as affected |
| Oracle Communications Diameter Signaling Router | 8.6.0, 9.0.0 |
| Oracle Communications EAGLE Application Processor | 17.0, 17.1 |
| Oracle Communications EAGLE Element Management System | 47.0 |
| Oracle Communications EAGLE LNP Application Processor | 11.1 |
| Oracle Communications LSMS | 14.0 |
| Oracle Communications Performance Intelligence Center (PIC) Software | 10.4, 10.5 |
| Oracle Communications Unified Assurance | 6.1.1–7.0.0 |
| Oracle Communications User Data Repository | 15.0 |
| Oracle Solaris | 11 |
| Oracle Secure Backup | 19.1.0.0.0–19.1.0.1.0 |
Oracle’s revision history records the Secure Backup addition on October 26, 2026. The advisory’s initial release was October 25.
What Oracle says about access and severity
Oracle identifies HTTP as the protocol for remote exploitation without authentication for CVE-2026-109618. It assigns that vulnerability a CVSS 3.1 base score of 9.8 in the listed product matrices. CVSS is a system for scoring the severity of security vulnerabilities.
The score applies to CVE-2026-109618. Oracle’s advisory does not state that 9.8 is a separate score for CVE-2026-109619.
INCIBE-CERT describes CVE-2026-109618 as an out-of-memory error-handling flaw that may leave request data uninitialized and later allow remote code execution. It describes CVE-2026-109619 as PHP retaining global references to freed memory that later requests may use to execute arbitrary code. Remote code execution means running code on a system from a remote connection.
Oracle says one patch addresses both CVEs
Oracle says its patch for CVE-2026-109618 also addresses CVE-2026-109619. The company directs customers to product-specific patch availability and installation documents in its Security Alert advisory.
Oracle says its Security Alert program provides patches only for product versions covered by Premier Support or Extended Support. It says earlier versions are likely also affected, although they were not tested for these vulnerabilities, and recommends upgrading to a supported version.
