Is OPSWAT Central Management Affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?
Check Your Version
Based on the product-level security assessment, the evaluated OPSWAT Central Management implementation does not use PHP.
Security Assessment: Not Affected
The evaluated OPSWAT Central Management implementation is not affected by CVE-2026-109618 or CVE-2026-109619 because it does not use PHP.
Overview
PHP2Shell refers to two security vulnerabilities in the PHP interpreter: CVE-2026-109618 and CVE-2026-109619. Under certain conditions, an affected PHP runtime may allow remote code execution.
Product Assessment
The evaluated OPSWAT Central Management implementation does not use PHP. These vulnerabilities affect the PHP interpreter and do not apply to the assessed product components.
Is Any Action Required?
No PHP2Shell-specific product patch or configuration change is required for the evaluated OPSWAT Central Management implementation. PHP installed separately as part of another application or service must be assessed independently.
Note: This article addresses only the two CVEs above. It does not assess other vulnerabilities or independently installed third-party software.
Additional Resources
Support
If you have questions about this security assessment or a reported vulnerability finding, please contact OPSWAT Support.
This article was last updated on 2026-10-22.