Peplink Security Advisory: PHP2Shell Vulnerability (CVE-2026-109618 and CVE-2026-109619)

Ref.: #38270

Published: 2026-10-22 [Last updated: 2026-10-28]

Background

Recently, we have had users highlight the php2shell vulnerability (CVE-2026-109618 and CVE-2026-109619), in this thread.

Details of the PHP2Shell vulnerability - CVEs can be found at:

1. CVE-2026-109618
2. CVE-2026-109619

The InControl Virtual Appliance (ICVA) - Control Panel on TCP port 4443 is affected by this vulnerability.

Peplink hosted InControl 2 (incontrol2.peplink.com) is not affected by this vulnerability.

The Balance and MAX routers with Edge Computing (EC) feature enabled and running will be affected, as the EC feature utilize a PHP component. The EC feature is disabled by default.

Products affected:

1. ICVA firmware version 2.14.3 and earlier.

2. Peplink Balance and MAX series with EC feature, found in firmware version 8.6.1 GA.
[Update: 2026-10-27] Verified and confirmed earlier firmware versions, 8.4.0 - 8.6.0, are vulnerable.
[Update: 2026-10-28] Other models are not affected.

Mitigation

(A) For ICVA, while waiting for the permanent fix (firmware 2.14.4), to immediately prevent potential attacks, please make sure the Control Panel isn’t reachable from the Internet. Restrict access to port 4443 to trusted networks only, such as a management VLAN or VPN.

(B) On Peplink Balance and MAX series with EC feature, ensure:

1. The Web Admin access is disabled on WAN side (Internal), to prevent external attacks.

2. If the ContentHub service is running, please disable it temporarily, or block inbound access from external (Internal) parties, while waiting for the permanent fix.

Solution

(A) ICVA firmware 2.14.4 is ready and can be downloaded from the ICVA firmware download page.
[Update: 2026-10-27] Recommended to go for ICVA 2.14.4.1, added some fixes on top of 2.14.4.

(B) Peplink Balance and MAX series with EC feature special firmware (8.6.1s042) is ready for download. The fix will be included in the next GA release.

Here are the direct download links for special firmware 8.6.1s042: