> For the complete documentation index, see [llms.txt](https://doc.engenius.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.engenius.ai/engenius-cloud-esp/security-advisories/php2shell-vulnerabilities.md). # PHP2Shell Vulnerabilities ## PHP engine vulnerabilities (PHP2Shell) | | | | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **CVE:** | CVE-2026-109618, CVE-2026-109619 | | **Publication Date:** | 2026-October-22 | | **Severity:** | Critical (CVSS v4.0 base score 9.2) | | **Reference:** | [PHP GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w), [PHP GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) | | **Status:** | Fixed | ### Overview On 21 October 2026, two critical vulnerabilities in the PHP engine, collectively known as PHP2Shell, were publicly disclosed by the PHP Group. These vulnerabilities (CVSS v4.0 base score 9.2, Critical) reside in the core PHP runtime that powers a large portion of web applications and web-based management interfaces. Successful exploitation can result in unauthenticated remote code execution on an affected device. Because the web management interface of the EnGenius Security Gateway (ESG) series is served by PHP, the ESG series is affected. ### Details The two vulnerabilities are memory-safety flaws (use-after-free) in the PHP engine itself, not in any specific application, so an affected device is exposed regardless of how its web interface is written. An attacker who can reach the device's web management interface can exploit them without authentication. * **CVE-2026-109618** — Remote code execution via out-of-memory corruption. A specially crafted HTTP request can exhaust the PHP engine's memory. When the engine aborts the request, it can leave internal memory in an invalid state that is later reused during request shutdown, allowing arbitrary code execution. * **CVE-2026-109619** — Remote code execution via stale global state. Internal engine state belonging to one request may not be cleared and can be reused by the next request handled by the same worker. This allows arbitrary code execution and, in some conditions, disclosure of memory contents belonging to other requests. At the time of publication, EnGenius is not aware of any malicious use of these vulnerabilities against EnGenius products. ### Affected Products The following EnGenius Security Gateway models are confirmed to be affected: * ESG320 * ESG510 * ESG610 * ESG620 The EnGenius Cloud service and all other EnGenius products are not affected by these vulnerabilities. ### Resolution The recommended action to completely fix these vulnerabilities is to update the device firmware to the fixed release for your model (see the table below). Update (23 October 2026): Fixed firmware v1.2.107 is now available for all affected models (ESG320, ESG510, ESG610, ESG620). Please upgrade your gateways from the EnGenius Cloud portal. After upgrading, you can re-enable any features you disabled as a workaround (Captive Portal, SecuPoint Client VPN, and local web management). If you cannot upgrade immediately, EnGenius recommends the following workarounds to remove the exposed attack surface until the fixed firmware is installed. In the EnGenius Cloud portal, * Disable Captive Portal\ Gateway → LAN (VLAN interfaces) → Captive Portal and set to disabled * Disable the SecuPoint Client VPN\ Gateway → Client VPN → SecuPoint and set to disabled * Disable the local web management page\ General Settings → Network → Local Web Pages Access Control and set Local web page to disabled Applying these workarounds disables the features that expose the vulnerable component and protects the device against these vulnerabilities. Note that doing so also turns off the corresponding features (captive portal, client VPN, and local web administration); upgrading to the fixed firmware release restores these features while keeping the device protected. EnGenius will continuously update this advisory as more information becomes available. #### ESG Series | Model | Patch Release | Release Date | Status | | ------ | ------------- | --------------- | -------- | | ESG320 | v1.2.107 | 23 October 2026 | Released | | ESG510 | v1.2.107 | 23 October 2026 | Released | | ESG610 | v1.2.107 | 23 October 2026 | Released | | ESG620 | v1.2.107 | 23 October 2026 | Released | ### Revision History | Date | Description | | --------------- | ------------------------------------------------------------------------------------------------ | | 22 October 2026 | Initial publication. | | 23 October 2026 | Fixed firmware v1.2.107 released for ESG320, ESG510, ESG610 and ESG620; status updated to Fixed. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://doc.engenius.ai/engenius-cloud-esp/security-advisories/php2shell-vulnerabilities.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.