topic Re: PHP2Shell Vulnerabilites on the ExtremeCLoud IQ Controller (XIQ-C) in ExtremeWireless (General)

PHP2Shell Vulnerabilites on the ExtremeCLoud IQ Controller (XIQ-C)

Max_S — Thu, 22 Oct 2026 10:02:24 GMT

Hello all,

is there any information if the ExtremeCloud IQ Controller uses a vulnerable PHP-Version?
(CVE-2026-109618 and CVE-2026-109619)

As there is a web-server running, possibly there is also a vulnerable PHP-Version in use.
Unfortunately i do not know a way to check the PHP-version on the server.

Could Extreme please provide guidance on if there is PHP in Use.
And if so, if the version in use is vulnerable and how to update the php-Version/ETA of a fixed Version.

Re: PHP2Shell Vulnerabilites on the ExtremeCLoud IQ Controller (XIQ-C)

tayla55bory — Tue, 27 Oct 2026 04:54:40 GMT

Hello,
Could Extreme please clarify whether ExtremeCloud IQ Controller uses PHP and, if so, which version is currently in use? Are CVE-2026-109618 and CVE-2026-109619 applicable to this product? Since the controller runs a web server, it would be helpful to have official confirmation of whether the system is affected and, if so, the planned fix, update procedure, and expected release date. Clear security guidance from Extreme would be greatly appreciated.

Best Regards
PeachPass com