On October 21, 2026, two critical PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) were made public. This article explains what the vulnerabilities are, confirms that Network Optix products aren’t affected, and recommends steps to protect your Nx accounts if you reused a password elsewhere.

Summary

Network Optix products don’t use PHP and aren’t affected by CVE-2026-109618 or CVE-2026-109619. This includes:

• Nx Witness and Nx Meta, including other Powered-by-Nx products
  • Nx Media Server and Server Web Admin
  • Desktop Client and Mobile Client
  • Nx Cloud

You don’t need to update or reconfigure your Site because of these vulnerabilities.

About the vulnerabilities

CVE-2026-109618 and CVE-2026-109619 are critical flaws in the PHP core. They let an unauthenticated attacker run code remotely on a web server that uses PHP, with a single request. A working exploit is publicly available, and attacks are ongoing.

The flaws affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team fixed the vulnerabilities in the following versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

If you run PHP on other servers in your network, update them to a fixed version or check your Linux distribution or software vendor for a patched package.

Change reused passwords

Although Network Optix products aren’t affected, many other websites and web applications run on PHP. If an attacker compromised one of those applications, they might have stolen the passwords stored or entered there. If you used the same password for an Nx account and for any other application, an attacker could reuse it to sign in to your Site or your Nx Cloud account if 2FA isn't enabled. 

If you reused a password, change it for the following accounts:

• Local Site users: Change the password of each local user that shares a password with another application.
• Nx Cloud account: Sign in to Nx Cloud and change your account password.

In case of doubt; change you passwords. 

For password requirements and instructions for each account type, see Password security and reset options.

Use a unique, strong password for each account. A password manager helps you create and store unique passwords.