topic Re: PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl in ExtremeCloud IQ- Site Engine Management Center

PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

RonaldW — Wed, 21 Oct 2026 16:57:48 GMT

Hi Extreme Community,

Following the critical PHP security vulnerability as reported today by the UK NCSC, we would like to understand the potential impact on XIQ-Site Engine (XIQ-SE) and ExtremeControl.

Reference: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

Could Extreme Networks clarify the following?

Are XIQ-Site Engine and ExtremeControl affected by this vulnerability?
If affected, is Extreme planning to release a security update or hotfix to address it?
Is it possible and officially supported to patch or upgrade PHP independently on XIQ-Site Engine and ExtremeControl, without waiting for a full product update?

We would particularly appreciate guidance on whether manually updating PHP could affect product functionality or support eligibility.

Thanks in advance for any clarification or recommendations.

Best regards,

Ronald

Re: PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

keri12lee — Thu, 22 Oct 2026 09:49:02 GMT

Hello,
Thank you for raising this important security concern. It would be helpful if Extreme Networks could clarify whether XIQ-Site Engine and ExtremeControl are affected by the reported PHP vulnerability and whether a security update or hotfix is planned. Guidance on whether PHP can be updated independently, and whether manual changes could impact product functionality or official support eligibility, would also be greatly appreciated. Security and system stability are essential, so an official recommendation would help administrators take the appropriate precautions.

Best Regards

Re: PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

Max_S — Thu, 22 Oct 2026 09:56:56 GMT

In addition to that, the same question goes for die CloudIQ-Controller for on premises.

Best Regards,
Max

Re: PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

WirelessHopper — Thu, 22 Oct 2026 11:43:53 GMT

And what about captive portals hosted via Extreme?

Re: PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

JordanR — Thu, 22 Oct 2026 11:49:29 GMT

Disappointing to not have any response from Extreme yet on such a high profile vulnerability?

Re: PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

Robert_Haynes — Thu, 22 Oct 2026 12:21:47 GMT

Providing ALL a quick response regarding the recent CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) PHP vulnerabilities.

Extreme Networks’ Product Security Incident Response Team (PSIRT) is actively investigating these vulnerabilities. At this time, the investigation is still in progress, and we do not yet have a confirmed product-impact status to share.

We will provide a further update once PSIRT has concluded its investigation.

Thank you for your patience while the investigation is completed.

When the Security Advisories go live, this thread -- and I assume many others will be updated.

Re: PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

abesio — Thu, 22 Oct 2026 19:02:11 GMT

I see an update:

https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-194-php2shell-rce-memory-corruption-cve-2026-109618/ba-p/122882

https://community.extremenetworks.com/t5/security-advisories-formerly/sa-2026-195-php2shell-rce-stale-global-state-cve-2026-109619/ba-p/122883

Re: PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

RonaldW — Fri, 23 Oct 2026 14:40:22 GMT

I see that ExtremeControl is still under investigation. For critical vulnerabilities like this, it would be helpful if Extreme could provide some recommended mitigation measures while the investigation is ongoing.

Re: PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

Robert_Haynes — Sun, 25 Oct 2026 14:51:44 GMT

See https://extreme-networks.my.site.com/ExtrArticleDetail?an=000139710

Re: PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

Paul99 — Tue, 27 Oct 2026 08:18:49 GMT

Hi everyone,

Has anyone already installed the field patch on a version lower than the one specified in the article as having been tested? Or even on the version that was tested, and can report whether any problems have occurred?

Is anyone waiting for the November release, which will include the updated binaries, rather than installing the packages manually right now?

Re: PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

Jordan — Tue, 27 Oct 2026 09:48:17 GMT

For most of my customers we've deployed the patch for the Extreme Control Engines without issue with them being on various different versions. The oldest version patched was 24.10.13.5 (with them to upgrade to latest code in due course).

Re: PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

Robert_Haynes — Tue, 27 Oct 2026 12:32:41 GMT

On that note (the upgrade in due course) please let this be an action item / reminder to our customers that Extreme supports the last 12 months of software releases for ExtremeCloud IQ - Site Engine, Control, Analytics. If you find your customers are on a release before ~ 25.11.10 at this point you should also work with them to ensure they upgrade to a supported release stream.

26.02.13 and 26.08.xx are recommended branches. That or wait for 26.11.10 so they can both upgrade and obtain the PHP patches in one go.

Thank you.