Versa Networks is aware of two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
No Versa Networks products are affected by these vulnerabilities.
CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities (CVSS v4.0 base score 9.2) in the core PHP runtime. Successful exploitation can allow an unauthenticated remote attacker to execute arbitrary code on a server running a vulnerable version of PHP.
The PHP project released fixes on October 21, 2026, in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
Both vulnerabilities exist only in PHP. PHP is not used in any Versa Networks product; therefore, no Versa Networks products are affected by CVE-2026-109618 or CVE-2026-109619.
No action is required for Versa Networks products.
If you run PHP on other systems in your environment, we recommend that you follow the guidance from the PHP project and your operating system vendor and upgrade to a fixed PHP version as soon as possible.
CWE-754 Improper Check for Unusual or Exceptional Conditions
CAPEC-153 Input Data Manipulation