We would like to bring to your attention a security advisory published by The PHP Group on 21 October 2026 about two critical remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). Their public statement is available here: PHP: News Archive - 2026.
Netwrix Endpoint Protector uses PHP in the affected versions. At this time, we have not identified any anomalous behavior or indicators of compromise in our hosted environment. What this means for you depends on how your instance is deployed:
Netwrix-hosted instances, patch in progress for EPP version 2608.0.1.0:
We are actively rolling out the patch released by PHP to your instance – you do not need to apply the patch yourself.
Netwrix-hosted instances, service paused for EPP version 2509-2604: For instances where the patch cannot be applied, we have taken the instance offline as a precaution until a remediation is in place.
Customer-hosted (on-premises) instances: You must take action in order to apply the patch provided by PHP to your Netwrix Endpoint Protector instance.To do so, follow these instructions: System Configuration | Netwrix Product Documentation
Older EPP appliance versions:
We strongly recommend migrating to version 2608 and then applying the security updates as described above. See the migration guide on docs.netwrix.com.
Before updating, take a VM snapshot and create a system backup from System Maintenance. Apply updates only through the web interface, because other methods are outside Netwrix support and can cause server malfunction. Some updates restart the server or its services automatically.
Our Security Team will publish more information as it becomes available on the Netwrix Community: Netwrix Community.
For urgent questions, please contact Netwrix Support.
I have to agree with those asking for a downloadable offline patch. I currently have open a support ticket due to the fact that internal update mechanism is broken on our instance of this product after migrating to 2608. Waiting to resolve this issue with support means leaving a vulnerable platform up and running while waiting for resolution.
Based on the description of the security update mechanism here, and knowing that the EPP appliance runs on Ubuntu, it’s likely that the updates are simply the PHP package upgrades distributed through Ubuntu’s security APT repository.
I really need a patch for version 2604 because our migration to version 2608 is stalled (have engaged Netwrix support on this matter). In addition, our 2608 test server cannot find the patch (which I have reported).
Thank you all for your queries.
As stated in Netwrix Security Advisory ADV-2026-021, we have listed the status of the php2shell vulnerability for each Endpoint Protector version.
We understand that migration requires time and effort, especially in production environments. However, for all on-premises customers, the only supported way to remediate is to migrate to the latest 2608 image and keep the backend security fixes up to date. In addition to the php2shell fix, it contains a number of other security fixes and improvements delivered in previous versions, which are listed in the earlier Security Advisories.
For appliances running versions 2511-2604, TuxCare PHP provider has just released a hotfix that can be applied via the backend security updates. However, we still recommend migrating to 2608 to cover the other security issues. We recommend that customers plan and complete the migration as soon as possible.
Please also note that version 5.9.4.2 has already reached end of life and no longer receives security updates.
Please be informed that the refreshed 2608-based images have been published on the my_products portal and are available to all active customers again. These images include the php2shell vulnerability fix.
Side note: This is one of the patching options for offline/air-gapped customers who are unable to install backend updates (“apt update” packages) on their own. It allows them to re-migrate to this image.
Notice: The image files are named 2608.0.1.1 only to differentiate them from the original release. The EPP product version remains 2608.0.1.0.
Hi @brett.atwell,
For AWS AMI deployments, please contact Netwrix Support. For the offline patch option, please see my answer above. If anything is unclear, please contact Netwrix Support.
BR, Krzysiek
