cPacket Products Are Not Vulnerable to PHP2SHELL

CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, are vulnerabilities resulting in unauthenticated remote code execution (RCE). Since their discovery, they have put a substantial portion of the web at risk and security teams are wise to assess their potential exposure across their environment.

cPacket products are not vulnerable to PHP2Shell as they do not use or run PHP code. This immunity extends to:

· All cVu Packet Broker models

· All cStor Packet Capture models

· cClear Control Center (including Grafana)

· cPacket Cloud Observability Suite

· cPacket AI

 As it pertains to cPacket products and PHP2Shell, no user action is required.