Citrix NetScaler and PHP2Shell

The statement

No public statement located as of 23 October 2026, 01:22 UTC at: https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/ (fetch failed twice, client error); https://support.citrix.com/securitybulletins (page loads only a JavaScript shell, no content readable); https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (NetScaler ADC listed Vulnerable citing this Citrix community security-updates post); fetch limit, retry next hour.

Notes

The Citrix community security-updates post that NCSC-NL cites could not be read in this run, so no statement is confirmed here. Reported by NCSC-NL inventory (status update 23 Oct 2026): NetScaler's PHP-based Management Portal (NSIP GUI, management-enabled SNIP GUI, Cluster IP GUI) impacted in all supported software versions, fixed package pending, Console and SVM not impacted. Unverified until the Citrix page is read.

Change log

• 23 October 2026: first check

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

A badge is issued once a public statement is located and verified on the company's own domain or verified official account.

Citrix NetScaler's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Citrix NetScaler and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.