Important: Portnox Cloud is not affected by the PHP2Shell vulnerability. An update for the UniFi agent container is planned for October 26, 2026. Click here for more information.

Home
Knowledge base
Security/Architecture
Does the PHP2Shell vulnerability affect Portnox Cloud users?
In this topic, you will find information about the PHP2Shell vulnerability and its impact on Portnox Cloud users.

Knowledge base
- Security/Architecture
  - Security architecture and principles
    In this topic, you will learn about the Portnox™ Cloud security principles and how they apply to every layer of the Portnox Cloud architecture.
  - Availability and reliability of Cloud
    In this topic, you will learn about the availability and reliability of the Portnox Cloud™ services.
  - Cloud maintenance and updates
    In this topic, you will find the answers to common questions about Portnox Cloud maintenance and updates.
  - Portnox Cloud shared responsibility model (SRM)
    This topic outlines the shared responsibility model (SRM) for Portnox Cloud SaaS tenants. It clarifies which security and operational tasks are owned by Portnox, the customer, or shared between both parties.
  - Blast-RADIUS vulnerability
    In this topic, you will find information about the Blast-RADIUS vulnerability and its impact on Portnox Cloud users.
  - New back-end IPs
    In this topic, you will learn about the new Portnox Cloud back-end IP ranges and where to add them to keep your Portnox Cloud services running without disruption.
  - Does the PHP2Shell vulnerability affect Portnox Cloud users?
    In this topic, you will find information about the PHP2Shell vulnerability and its impact on Portnox Cloud users.
- Certificates
- Licensing
- Portnox Cloud portal
- Network access
- Onboarding
- Cloud RADIUS
- Local RADIUS instances
- Local TACACS+ instances
- LDAP Broker
- AgentP
- Docker containers and VMs
- NAS devices
- Guest network (captive portal)
- Zero Trust Network Access
- Integrations
- Risk assessment/Remediation
- Fingerprinting and tracking
- Support

Does the PHP2Shell vulnerability affect Portnox Cloud users?

In this topic, you will find information about the PHP2Shell vulnerability and its impact on Portnox Cloud users.

Portnox does not use PHP in its products. Portnox Cloud is not affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

The only exception is the Portnox UniFi agent Docker container (portnox-unifi-agent). Portnox plans to release an updated version of this container on Monday, October 26, 2026.

If you use the portnox-autoupdate container, the UniFi agent updates automatically when the new version is available. For more information, see the following topic: Automatic updates for Docker containers (portnox-autoupdate).
If you don’t use the portnox-autoupdate container, redeploy the UniFi agent container manually with the latest image.

What is PHP2Shell?

PHP is a programming language that many websites and web applications run on. PHP2Shell is the name for two critical vulnerabilities in the PHP runtime, disclosed in October 2026:

CVE-2026-109618: An attacker can trigger an out-of-memory condition that corrupts memory.
CVE-2026-109619: PHP error handling leaves global memory pointing to memory that was already freed.

Both vulnerabilities have a critical CVSS v4.0 severity score of 9.2. An attacker can use them to run code on a web server remotely, without logging in. The attack happens while PHP processes uploaded form data, before the application code runs. Attackers started exploiting the vulnerabilities before patches were available.

PHP fixed the vulnerabilities in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.