MSP360 Products Are Not Affected by PHP2Shell
MSP360 products do not use PHP and are not affected by the recently disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
Customers can continue using MSP360 software as usual. No product updates, configuration changes, or other actions are required to protect MSP360 products against these vulnerabilities.
What Happened?
On October 21, 2026, the PHP development team released emergency security updates for two critical vulnerabilities, collectively known as PHP2Shell. Both carry a CVSS v4.0 score of 9.2 and could allow attackers to execute code on vulnerable web servers without authentication.
The issue is particularly serious because exploitation attempts began before the official patches were available. AWS Threat Intelligence identified attempts dating back to October 17, and the UK's National Cyber Security Centre (NCSC) has urged organizations to update affected systems immediately.
The vulnerabilities affect how PHP handles memory while processing web requests. Applications and services that use affected PHP runtimes may be vulnerable to remote code execution.
Why MSP360 Products Are Not Affected
PHP2Shell affects the PHP runtime itself, rather than any specific website or application. If a product doesn't use PHP, these vulnerabilities don't apply to it.
MSP360 Backup, RMM, and Connect don't use PHP, so there's no vulnerable PHP component to exploit. Customers can keep using these products as usual, with no additional patches or configuration changes needed.
What About Other Software in Your Environment?
Although MSP360 products are not affected, other applications or servers in your environment may use PHP, including PHP bundled with third-party software, appliances, and services.
If you manage PHP-based websites, business applications, or servers, we recommend checking whether they are running an affected PHP version and applying the appropriate security updates.
The PHP project released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older PHP versions may require updates from operating system vendors or migration to a supported release.
Potentially exposed systems should also be assessed for signs of compromise, particularly if they could not be patched or disabled immediately. Patching does not remove backdoors an attacker may already have installed.
For detailed remediation guidance, see the UK NCSC security advisory.
Questions About MSP360 Security?
No action is required in MSP360 products in response to PHP2Shell. If you have questions about these vulnerabilities or their impact on MSP360 software, please contact our support team.
Official sources: