# Source: Product Notice: SonicWall Products and PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

SonicWall: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · primary · captured

# Product Notice: SonicWall Products and PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

**SonicWall** · [https://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AG](https://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AG) · published 2026-10-22 · added by `breaking@php.newsroom (curator's role)` · slug `sonicwall-php-product-notice`

Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 2 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). SonicWall product notice (PUBLISHED: OCTOBER 22, 2026; LAST UPDATED: OCTOBER 27, 2026).

## What it says, as the collector read it

#### Product Notice: SonicWall Products and PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault `7r83qic5`), page `us/security-vendor/sonicwall/sonicwall-php-product-notice`, snapshot `20261027T191336Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T191336Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Read in the curator's role._

SonicWall product notice (PUBLISHED: OCTOBER 22, 2026; LAST UPDATED: OCTOBER 27, 2026).

> The SonicWall Product Security Incident Response Team (PSIRT) performed an initial review and found no use of PHP in the following products. Based on this review, SonicWall has no indication that these CVEs apply to them.

> This is the current assessment and is not a statement covering the entire SonicWall portfolio.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): SonicWall product notice (22 Oct, updated 27 Oct): PSIRT found no use of PHP in SonicOS, SMA 1000, NSM and other listed products; IPS signatures released.

Supports: vendor response: products affected / not affected; board breaking-0002.

#### Capture notes

Language `en`. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:14:15Z. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261027T191336Z · HTTP 200 · https://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AG- `headers.json` ac69f8ea53ba50ba872a343f8069d9ba816c73a32002661e9eb923456ad07593 5,931 bytes
- `page.html` e758a61dfa5217cbea533698161b8290f48c12117f46c1cba06aa70858c235c6 222,027 bytes
- `provenance.json` f54e6801c513a73b9fbf032d098d4d9ab8fe138f9c540745214660d2874874ea 1,873 bytes
- `rendered.html` d745124635483f3388390ac9c42bb6b9e4bae7bdf4ab1d33f9c4a3b3a1053f8f 307,307 bytes
- `screenshot.jpg` a56550968b4ac99659c83ba848c9256112b0be543f8edb098f9baedd71c8121d 106,523 bytes
- `text.txt` b29a79a85a7a94a6c8c34a4095a24fec5730263df435d53a6911dee5b25015de 3,598 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.49 · data as of 2026-10-27T19:13Z · vault commit 6f0d5c50bf12 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/sonicwall-php-product-notice/index.html