Ref.: #38270
Published: 2026-10-22 [Last updated: 2026-10-28]
Background
Recently, we have had users highlight the php2shell vulnerability (CVE-2026-109618 and CVE-2026-109619), in this thread.
Details of the PHP2Shell vulnerability - CVEs can be found at:
The InControl Virtual Appliance (ICVA) - Control Panel on TCP port 4443 is affected by this vulnerability.
Peplink hosted InControl 2 (incontrol2.peplink.com) is not affected by this vulnerability.
The Balance and MAX routers with Edge Computing (EC) feature enabled and running will be affected, as the EC feature utilize a PHP component. The EC feature is disabled by default.
Products affected:
1. ICVA firmware version 2.14.3 and earlier.
2. Peplink Balance and MAX series with EC feature, found in firmware version 8.6.1 GA.
[Update: 2026-10-27] Verified and confirmed earlier firmware versions, 8.4.0 - 8.6.0, are vulnerable.
[Update: 2026-10-28] Other models are not affected.
Mitigation
(A) For ICVA, while waiting for the permanent fix (firmware 2.14.4), to immediately prevent potential attacks, please make sure the Control Panel isn’t reachable from the Internet. Restrict access to port 4443 to trusted networks only, such as a management VLAN or VPN.
(B) On Peplink Balance and MAX series with EC feature, ensure:
1. The Web Admin access is disabled on WAN side (Internal), to prevent external attacks.
2. If the ContentHub service is running, please disable it temporarily, or block inbound access from external (Internal) parties, while waiting for the permanent fix.
Solution
(A) ICVA firmware 2.14.4 is ready and can be downloaded from the ICVA firmware download page.
[Update: 2026-10-27] Recommended to go for ICVA 2.14.4.1, added some fixes on top of 2.14.4.
(B) Peplink Balance and MAX series with EC feature special firmware (8.6.1s042) is ready for download. The fix will be included in the next GA release.
Here are the direct download links for special firmware 8.6.1s042:
| Download Link | Product | Hardware Revision |
|---|---|---|
| Download | B One | HW1 |
| B One 5G | HW1-2 | |
| B One Plus | HW1-2 | |
| Balance 310 | HW5 | |
| Balance 310 5G | HW3 | |
| Balance 580X | HW2 | |
| MAX BR1 Pro 5G | HW3 | |
| MAX BR2 Pro | HW4-5 | |
| MAX Orbit 2 | HW1 | |
| MAX Orbit 4 | HW1 | |
| MAX Orbit 8 | HW1 | |
| MAX Transit Duo Pro | HW1-3 | |
| MAX Transit Pro E | HW2-3 | |
| Download | Balance 1350 EC | HW1 |
| Balance 2500 EC | HW1 | |
| Balance 310 5G | HW1-2 | |
| Balance 310 Fiber 5G | HW1-2 | |
| Balance 310X | HW1-3 | |
| Balance 380X | HW1 | |
| Balance 5000 EC (100G) | HW1 | |
| Balance 5000 EC (40G) | HW1 | |
| Balance 580X | HW1 | |
| EPX | HW1 | |
| MAX HD2 MBX | HW1-4 | |
| MAX HD4 MBX | HW1-4 | |
| MAX MBX Mini | HW1-2 | |
| PDX | HW1-2 | |
| SDX | HW1-4 | |
| SDX Pro | HW2 | |
| Download | MediaFast 500 | HW1-2 |
| MediaFast 750 | HW1 |