Citrix lists NetScaler builds that fix the exploited PHP2Shell flaws

Citrix says the PHP flaws known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, affect customer-managed NetScaler ADC and NetScaler Gateway. On Oct 27 it updated its bulletin with the builds that fix them and urged customers to install them as soon as possible. CISA added both flaws to its KEV catalog on Oct 26. Citrix says it has fixed its managed cloud services, and that its other on-premises products aren’t affected.

Citrix first published its bulletin on Oct 22 and rates it critical. It changed the builds it lists as fixed on Oct 27, including the FIPS and NDcPP builds. The bulletin points to a Citrix blog post on protecting NetScaler management access from the flaws for mitigation guidance.

Citrix lists its other on-premises products as not affected, among them NetScaler Console, Secure Access, Secure Private Access, Virtual Apps and Desktops, Workspace app, StoreFront, Endpoint Management and XenServer.

Wiz, which found the flaws, said on Oct 27 that none of the exploitation attempts it has captured succeeded. It hasn’t found a public exploit that works end to end against an arbitrary target. The attempts on the flaws used two versions of one open-source exploit kit. The older hit PHP’s request size limit, and the newer exhausted PHP’s memory but failed to leak the addresses its next stage needs.

Wiz says the daily count of vulnerable, internet-exposed machines it sees fell about 67% in the days after disclosure. A week after disclosure, fewer than 53% of the organizations first affected were still vulnerable.