Important Update: Endpoint Central and the Secure Gateway Server are not affected by these CVEs. The vulnerabilities only impact the PHP runtime. Because our products do not use or bundle PHP as part of our product stack, they are completely secure against these risks.
Two critical vulnerabilities, collectively referred to as PHP2Shell, have been reported in PHP, raising serious security concerns for websites and applications running on affected PHP installations.
Both vulnerabilities have been assigned a CVSS v4.0 severity score of 9.2 and are reported to allow remote code execution (RCE). Successful exploitation could enable attackers to execute malicious commands on vulnerable servers, potentially leading to unauthorized access, data theft, and system compromise.
Vulnerability Name: PHP2Shell
CVE IDs: CVE-2026-109618 and CVE-2026-109619
Severity: Critical
CVSS v4.0 score: 9.2
Impact: Remote code execution
Platform: Windows
PHP is used as a portable application without requiring a traditional installation. As a result, such PHP installations may not be identified through conventional vulnerability scans.
To enable vulnerability detection for these portable PHP installations, kindly contact our support team to enable Drive Scan on your managed computers. Drive Scan helps identify PHP files and binaries present on the endpoints, allowing affected installations to be assessed for these vulnerabilities.