PHP2Shell statement record · Platform
Status in the company's own words: patched. Statement dated October 21, 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on www.netgate.com, dated . Source type: official page.
Post Critical PHP Security Update
names CVE-2026-109618 and CVE-2026-109619 and ships updated PHP packages for pfSense Plus 26.07 and 26.03.1 and pfSense CE 2.9.0 (PHP 8.5.12) and CE 2.8.1 (PHP 8.3.36). Customer must apply them from the command line: These binary package updates cannot be performed using the pfSense software PHP GUI or the Nexus GUI.
and Anyone who has exposed their GUI to the Internet or other untrusted networks should update PHP immediately.
quoted from the statement URL. Three methods: full package update then reboot, or update then restart PHP GUI, web GUI and Captive Portal, or restart PHP GUI only; WireGuard package reinstalled last. Users of older releases urged to move to a current supported release; GUI reachable only from LAN by default and Captive Portal inactive by default.
match
Yes—pfSense is affected, and Netgate has released patches. As of October 23, 2026, Netgate’s official advisory confirms both CVE-2026-109618 and CVE-2026-109619 affect pfSense installations. The advisory was published October 21, 2026. Exposure The relevant attack surfaces are the PHP management GUI and Captive Portal when reachable by potential attackers. The GUI is LAN-only by default; Captive Portal is disabled
no status named
Yes, pfSense is affected by PHP2Shell, and patches have been released. Here is a full breakdown with sources: PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — Impact on pfSense What is PHP2Shell? The PHP project released fixes on October 21, 2026, for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both carry a CVSS v4.0 score of 9.2 (Critical Severity).
no status named
Yes. pfSense is affected because its web-management components use PHP, and Netgate has released fixed PHP packages for supported pfSense versions. Patched versions listed by the NCSC-NL PHP2Shell tracker are: pfSense Plus 26.07 and 26.03.1: PHP 8.5.12 pfSense CE 2.9.0: PHP 8.5.12 pfSense CE 2.8.1: PHP 8.3.36 The fix addresses CVE-2026-109618 and CVE-2026-109619. Existing installations reportedly require a command-line
no status named
Yes, pfSense is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because it uses PHP for its webConfigurator GUI and backend scripts, though exposure depends heavily on network access. Netgate published an official security advisory stating that users can update their systems through System > Update > Update Settings to apply the latest package and PHP fixes. Key Details
no status named
You’ve reached the request limit for AI responses right now. Try again in a little while.
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for pfSense, Netgate reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
pfSense, Netgate's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about pfSense, Netgate and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy