CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Xerox EC81xx

product · product:xerox-ec81xx single-source

Coverage
1
first 2026-11-02 → last 2026-11-02
Latest activity
2026-11-02
PHP2Shell affects Xerox AltaLink and VersaLink printers and Fiery controllers; fixes due 6 to 23 November
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
2
2 hosts

Defender insights

What each entry about Xerox EC81xx tells a defender to do, newest first.

2026-11-02NOTABLEexploitedPHP2Shell affects Xerox AltaLink and VersaLink printers and Fiery controllers; fixes due 6 to 23 November

Exposure

Story timeline

  1. 2026-11-02CVE-2026-109618 / CVE-2026-109619, Xerox AltaLink, EC81xx, VersaLink and WorkCentre printers and Fiery print controllers: Xerox lists them as affected by the PHP2Shell flaws, with fixes expected on 2026-11-06 and Fiery patches between 2026-11-09 and 2026-11-23
    trending-vulnerabilitiesPHP2Shell affects Xerox AltaLink and VersaLink printers and Fiery controllers; fixes due 6 to 23 November

Hunting pivots

CVEs (exploited first)
CVE-2026-109618CVE-2026-109619
Releases covered
Xerox EC81xx
Tags
cisa-kevno-patchvulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-02/xerox-fiery-php2shell-printers-fixes-due-6-to-23-november · ATT&CK page ↗

Entries about Xerox EC81xx (1)

2026-11-02 · view entry permalink →

NOTABLECVE-2026-109618 +1exploitedNATOA2

CVE-2026-109618 / CVE-2026-109619, Xerox AltaLink, EC81xx, VersaLink and WorkCentre printers and Fiery print controllers: Xerox lists them as affected by the PHP2Shell flaws, with fixes expected on 2026-11-06 and Fiery patches between 2026-11-09 and 2026-11-23

Xerox's security bulletin XRX26-016, published 2026-10-23 and updated on 2026-10-28, lists Xerox AltaLink and EC81xx products, VersaLink C/B415, C/B625 and C/B620, WorkCentre 3655, EC7836 and EC7856, the Fiery Digital Front End and the Worldwide Ticketing Tool as affected by the PHP flaws CVE-2026-109618 and CVE-2026-109619 (Xerox, 2026-10-28). No fixed build is out: Xerox says the AltaLink, EC81xx and VersaLink fixes are being tested and expected on its website on 2026-11-06, the WorkCentre models and the Ticketing Tool are in development, and Fiery's target patch dates are by 2026-11-09 for FS800, FS700, FS600 and FS500 including the Pro editions, by 2026-11-16 for FS400, FS350 and FS300, and by 2026-11-23 for FS200 (Xerox, 2026-10-28). The bulletin does not name the affected interface or PHP version, offers no workaround and reports no attack on these devices, while CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26 and describes each as allowing unauthenticated remote code execution in PHP (CISA KEV, 2026-10-30).

Xerox is aware of the recently disclosed critical vulnerabilities in the PHP runtime

Fix being tested. Expected to post to web November 6, 2026.

Xerox (Security Bulletin XRX26-016, version 4) 2026-10-28

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the… · PAN-OS management interfaces were rooted in the wild via PHP2Shell and a kernel flaw: hotfix… · NetScaler's PHP2Shell fix is out: 14.1-73.49, 13.1-64.32 and FIPS builds; restrict management… · PHP2Shell hits QNAP NAS before login: QTS, QuTS hero, QVR, TVR OS and Notes Station 3 fixed… · PHP2Shell hits NetModule routers (fix: NRSW 5.0.0.105), macmon, Schneider, B&R, HMS, Wibu and… · Cisco's final PHP2Shell advisory: Expressway needs 15.5.21, Duo Access Gateway 3.2.0; Cisco… · HPE ClearPass 6.14, 6.12 and 6.11 are affected by PHP2Shell; a hotfix patch exists for each… · Check Point: PHP2Shell hits gateway VPN and portal web interfaces; hotfixes out, R81.20 package… · F5 BIG-IP is affected by PHP2Shell: fixes are in 17.1.3.7, 17.5.1.11 and 21.1.0.4; APM data… · PHP2Shell: Trend Micro Apex Central and Apex One await patches to 11 Nov; Quest KACE and NetApp… · PHP2Shell hits Broadcom endpoint-security servers: App Control 8.12.2 or 8.13.2; SEPM fix… · CVE-2026-46300 (Fragnesia): CISA lists the Linux kernel root flaw as exploited, chained with… · Camping.Care booking data stolen: TCS and a second campsite warn of WhatsApp fraud; PHP link…

vulnerability02 Nov 04:24Zsingle-sourceOpen finding →
Sources: Xerox (Security Bulletin XRX26-016, version 4) · CISA Known Exploited Vulnerabilities catalog (version 2026.10.30)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cisa.gov1 (50%)
  • securitydocs.business.xerox.com1 (50%)
All cited sources (2)