Is MetaDefender ICAP Server Affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?
Check Your Version
Based on the product-level security assessment, MetaDefender ICAP Server does not use PHP.
Security Assessment: Not Affected
MetaDefender ICAP Server is not affected by CVE-2026-109618 or CVE-2026-109619 within the assessed product scope.
Overview
PHP2Shell refers to two security vulnerabilities in the PHP interpreter: CVE-2026-109618 and CVE-2026-109619. Under certain conditions, an affected PHP runtime may allow remote code execution.
Product Assessment
MetaDefender ICAP Server does not use the PHP interpreter targeted by these vulnerabilities.
Is Any Action Required?
No product-specific patch, hotfix or configuration change is required for the assessed product to address these two PHP vulnerabilities. PHP installed separately as part of another application or service must be assessed independently.
Note: This article addresses only the two CVEs above. It does not assess other vulnerabilities or independently installed third-party software.
Additional Resources
Support
If you have questions about this security assessment or a reported vulnerability finding, please contact OPSWAT Support.
This article was last updated on 2026-10-22.