CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

F5 BIG-IP SSL Orchestrator

product · product:f5-big-ip-ssl-orchestrator single-source

Coverage
1
first 2026-10-29 → last 2026-10-29
Latest activity
2026-10-29
F5 BIG-IP is affected by PHP2Shell: fixes are in 17.1.3.7, 17.5.1.11 and 21.1.0.4; APM data plane and TMUI…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
5
3 hosts

Action items (1)

Do-now tasks recorded on the entries about F5 BIG-IP SSL Orchestrator, newest first. Check the date before acting on an older one.

  • Update every F5 BIG-IP on 17.1, 17.5 or 21.1 to 17.1.3.7, 17.5.1.11 or 21.1.0.4, systems that publish an APM or SSL Orchestrator access profile first, because NCSC-NL records the access-profile data plane as exposed as well as the Configuration utility.
    2026-10-29CVE-2026-109618 +1

Defender insights

What each entry about F5 BIG-IP SSL Orchestrator tells a defender to do, newest first.

2026-10-29NOTABLEexploitedF5 BIG-IP is affected by PHP2Shell: fixes are in 17.1.3.7, 17.5.1.11 and 21.1.0.4; APM data plane and TMUI exposed

Exposure · detection

Story timeline

  1. 2026-10-29CVE-2026-109618 / CVE-2026-109619, F5 BIG-IP: the PHP2Shell flaws reach the Configuration utility of every module and the APM and SSL Orchestrator access profiles on 17.1.0 to 17.1.3, 17.5.0 to 17.5.1 and 21.1.0, and F5's cumulative critical releases 17.1.3.7, 17.5.1.11 and 21.1.0.4 carry the fix
    trending-vulnerabilitiesF5 BIG-IP is affected by PHP2Shell: fixes are in 17.1.3.7, 17.5.1.11 and 21.1.0.4; APM data plane and TMUI exposed

Hunting pivots

CVEs (exploited first)
CVE-2026-109618CVE-2026-109619
Releases covered
F5 BIG-IP SSL Orchestrator
Tags
cisa-kevpatch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-29/f5-big-ip-php2shell-k000163821-critical-releases · ATT&CK page ↗

Entries about F5 BIG-IP SSL Orchestrator (1)

2026-10-29 · view entry permalink →

NOTABLECVE-2026-109618 +1exploitedNATOA2

CVE-2026-109618 / CVE-2026-109619, F5 BIG-IP: the PHP2Shell flaws reach the Configuration utility of every module and the APM and SSL Orchestrator access profiles on 17.1.0 to 17.1.3, 17.5.0 to 17.5.1 and 21.1.0, and F5's cumulative critical releases 17.1.3.7, 17.5.1.11 and 21.1.0.4 carry the fix

F5's release notes for BIG-IP 17.1.3.7, 21.1.0.4 and 17.5.1.11, each updated on 2026-10-24, list K000163821 as the reference for the fix of the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 and describe each build as a critical release whose only new changes are PHP vulnerability fixes and which is cumulative and includes earlier hardened and critical releases (F5, 2026-10-24; F5, 2026-10-24; F5, 2026-10-24). NCSC-NL records F5 as confirming that BIG-IP 17.1.0 to 17.1.3, 17.5.0 to 17.5.1 and 21.1.0 are vulnerable through the Configuration utility control plane in all modules and, for APM and SSL Orchestrator, through the access-profile data plane, and that earlier affected releases stay vulnerable until updated (NCSC-NL, 2026-10-26). CISA lists both PHP flaws as exploited since 2026-10-26; nothing found reports an attack on BIG-IP (CISA KEV, 2026-10-28).

The only new changes in this release are PHP vulnerability fixes.

F5 (BIG-IP 21.1.0.4 release notes) 2026-10-24

F5 K000163821, updated 2026-10-24, lists fixes in 17.1.3.7, 17.5.1.11 and 21.1.0.4 for both CVEs.

NCSC-NL (PHP2Shell software status list) 2026-10-26

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the… · Palo Alto reports active exploitation of PAN-OS management interfaces via PHP2Shell; 19 of 20… · NetScaler's PHP2Shell fix is out: 14.1-73.49, 13.1-64.32 and FIPS builds; restrict management… · PHP2Shell hits QNAP NAS before login: QTS, QuTS hero, QVR and TVR OS fixed, Notes Station 3 and… · PHP2Shell hits NetModule routers with no fix, macmon, Schneider, B&R, HMS, Wibu and Oracle… · Cisco's final PHP2Shell advisory: Expressway needs 15.5.21, Duo Access Gateway 3.2.0; Cisco… · HPE ClearPass through 6.14.1 and 6.11.16 is affected by PHP2Shell; hotfix patches exist for… · CVE-2026-46300 (Fragnesia): CISA lists the Linux kernel root flaw as exploited, chained with… · Camping.Care booking data stolen: TCS and a second campsite warn of WhatsApp fraud; PHP link… · Check Point: PHP2Shell hits gateway VPN and portal web interfaces; hotfixes out, R81.20 package… · PHP2Shell: Trend Micro Apex Central and Apex One await patches to 11 Nov; Quest KACE and NetApp…

vulnerability29 Oct 04:49Zsingle-sourceOpen finding →
Sources: F5 (BIG-IP 21.1.0.4 release notes) · F5 (BIG-IP 17.5.1.11 release notes) · F5 (BIG-IP 17.1.3.7 release notes) · NCSC-NL (PHP2Shell software status list) · CISA Known Exploited Vulnerabilities catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • techdocs.f5.com3 (60%)
  • cisa.gov1 (20%)
  • raw.githubusercontent.com1 (20%)
All cited sources (5)