Skip to main content
Sign in More Resources

Netsweeper Security Advisory - PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

Dan Thompson
  • Updated

Summary

On October 20, 2026, details of two critical vulnerabilities in PHP leaked and began circulating ahead of their scheduled disclosure. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and known collectively as PHP2Shell, with each flaw identified as CVSS v4.0 9.2. Netsweeper already has max upload and max post sizes implemented on default installs for all releases.

Netsweeper by default limits the upload size to 200Mbyte on EL8 and 2Mbyte of EL6. Although the memory limit is set to 256Mbytes to actively exploit the memory limit you need to get the application to consume more memory with a limited upload size of 200Mbytes. It is technically possible to exploit php2shell with the right product knowledge.

What is this vulnerability?

PHP (PHP Hypertext Preprocessor) is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user's browser. 

This vulnerability could allow an attacker to trigger an out-of-memory (OOM) condition in PHP, resulting in memory corruption. There is a potential that this corruption could be exploited in order to achieve unauthenticated remote code execution.

What actions should I take?

  • Users of Netsweeper cloud services do not need to take any action at this time, as we have maintenance windows scheduled already (as of October 21st, 2026) to implement the necessary changes.
  • Users who host their own deployments should schedule maintenance windows in order to run the changes in below.

Netsweeper 7.2 to 9.2.3 running EL8

The Netsweeper EL8 releases have a maximum file upload size of “php_value[upload_max_filesize] = 200M”, and a “php_value[post_max_size] = 201M” so adjusting the memory usage to unlimited is a safe option, given you never run into a memory limit.

cd ~/
mkdir php2shell.back/
cp /etc/php-fpm.d/*.conf php2shell.back/
perl -pi -e 's@^php_value\[memory_limit\][ \t]*=[ \t]*[0-9]+[MG]*$@php_value[memory_limit] = -1@' /etc/php-fpm.d/*.conf
perl -pi -e 's@^php_value\[post_max_size\][ \t]*=[ \t]*[0-9]+[MG]*$@php_value[post_max_size] = 8M@' /etc/php-fpm.d/*.conf
perl -pi -e 's@^php_value\[upload_max_filesize\][ \t]*=[ \t]*[0-9]+[MG]*$@php_value[upload_max_filesize] = 32M@' /etc/php-fpm.d/*.conf
perl -pi -e 'if (s/^php_value\[session.upload_progress.enabled\][ \t]*=.*/php_value[session.upload_progress.enabled] = Off/) { $found = 1; } if (eof && !$found) { $_ .= "\nphp_value[session.upload_progress.enabled] = Off\n"; }' /etc/php-fpm.d/ns_webadmin.pool.conf
systemctl try-restart php-fpm

Netsweeper 7.2 and older running EL6

The EL6 releases of netsweeper enforce a “upload_max_filesize = 2M” of only 2Mbyte. and “post_max_size = 8M”. The following simply changes the memory limit and makes sure you are limited to the EL6 defaults Netsweeper shipped with.

cd ~/
mkdir php2shell.back/
cp /etc/php.d/ns_webadmin.ini php2shell.back/
cp /etc/php.ini php2shell.back/
perl -pi -e 's@^memory_limit[ \t]*=[ \t]*[0-9]+[MG]*$@memory_limit=-1@' /etc/php.d/ns_webadmin.ini
perl -pi -e 's@^post_max_size[ \t]*=[ \t]*[0-9]+[MG]*$@post_max_size=8M@' /etc/php.ini
perl -pi -e 's@^upload_max_filesize[ \t]*=[ \t]*[0-9]+[MG]*$@upload_max_filesize=2M@' /etc/php.ini

service httpd condrestart

Please Note: Whether your are running EL8 or EL6, The respective commands should be run on all Netsweeper servers in a deployment, whether the 'web' service is running on that server or not.

Where can I find more information?

Additional information on this vulnerability can be found in the following:

Related to

Related articles