PHP2Shell reaches network gear: Peplink patches InControl Virtual Appliance and Balance/MAX routers running Edge Computing

confirmed (Peplink security advisory, Oct 23); Peplink does not report exploitation of its products2026-10-23

PHP2Shell reaches network gear: Peplink patches InControl Virtual Appliance and Balance/MAX routers running Edge Computing

Peplink says the PHP2Shell bugs (CVE-2026-109618 and CVE-2026-109619) affect its on-prem InControl Virtual Appliance (ICVA) 2.14.3 and earlier and Balance and MAX routers with the Edge Computing feature on firmware 8.6.1 GA. ICVA 2.14.4 is out now; fixed router firmware is rolling out. Peplink-hosted InControl 2 is not affected. Peplink's advisory lists ways to block outside access until you can update.

Why it matters: the PHP fix landing on a server doesn't cover appliances that ship their own PHP runtime. Edge and management appliances need their own vendor updates, so check each vendor's PHP2Shell notice rather than assuming a distro update reached them.

Sources: Peplink newsroom: PHP2Shell security advisory (Oct 23) · PHP security advisory (Oct 21)