PHP Security Vulnerability – Patch Availability for XIQ-Site Engine and ExtremeControl

[RonaldW]

Hi Extreme Community,

Following the critical PHP security vulnerability as reported today by the UK NCSC, we would like to understand the potential impact on XIQ-Site Engine (XIQ-SE) and ExtremeControl.

Reference: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

Could Extreme Networks clarify the following?

1. Are XIQ-Site Engine and ExtremeControl affected by this vulnerability?
2. If affected, is Extreme planning to release a security update or hotfix to address it?
3. Is it possible and officially supported to patch or upgrade PHP independently on XIQ-Site Engine and ExtremeControl, without waiting for a full product update?

We would particularly appreciate guidance on whether manually updating PHP could affect product functionality or support eligibility.

Thanks in advance for any clarification or recommendations.

Best regards,

Ronald

[JordanR]

Disappointing to not have any response from Extreme yet on such a high profile vulnerability? 

[WirelessHopper]

And what about captive portals hosted via Extreme?

[Max_S]

In addition to that, the same question goes for die CloudIQ-Controller for on premises.

Best Regards, 
Max

[keri12lee]

Hello,
Thank you for raising this important security concern. It would be helpful if Extreme Networks could clarify whether XIQ-Site Engine and ExtremeControl are affected by the reported PHP vulnerability and whether a security update or hotfix is planned. Guidance on whether PHP can be updated independently, and whether manual changes could impact product functionality or official support eligibility, would also be greatly appreciated. Security and system stability are essential, so an official recommendation would help administrators take the appropriate precautions.

Best Regards