---
title: PHP2Shell reaches network gear: Peplink patches InControl Virtual Appliance and Balance/MAX routers running Edge Computing | ctxsec
url: https://ctxsec.com/items/peplink-php2shell-icva-balance-max-edge-fixes
description: ""
status: "confirmed (Peplink security advisory, Oct 23); Peplink does not report exploitation of its products"
published: 2026-10-23
---

> 

[← Cybersecurity News](/news) · [markdown](/items/peplink-php2shell-icva-balance-max-edge-fixes.md)

confirmed (Peplink security advisory, Oct 23); Peplink does not report exploitation of its products

2026-10-23

### PHP2Shell reaches network gear: Peplink patches InControl Virtual Appliance and Balance/MAX routers running Edge Computing

Peplink says the PHP2Shell bugs (**CVE-2026-109618** and **CVE-2026-109619**) affect its on-prem **InControl Virtual Appliance (ICVA) 2.14.3 and earlier** and **Balance and MAX routers with the Edge Computing feature on firmware 8.6.1 GA**. ICVA **2.14.4** is out now; fixed router firmware is rolling out. Peplink-hosted InControl 2 is not affected. Peplink's advisory lists ways to block outside access until you can update.

Why it matters: the PHP fix landing on a server doesn't cover appliances that ship their own PHP runtime. Edge and management appliances need their own vendor updates, so check each vendor's PHP2Shell notice rather than assuming a distro update reached them.

Sources: [Peplink newsroom: PHP2Shell security advisory (Oct 23)](https://www.peplink.com/newsroom/peplink-security-advisory-php2shell-vulnerability/) · [PHP security advisory (Oct 21)](https://www.php.net/archive/2026.php#2026-10-20-1)