CVE-2026-109618 / CVE-2026-109619, F5 BIG-IP: the PHP2Shell flaws reach the Configuration utility of every module and the APM and SSL Orchestrator access profiles on 17.1.0 to 17.1.3, 17.5.0 to 17.5.1 and 21.1.0, and F5's cumulative critical releases 17.1.3.7, 17.5.1.11 and 21.1.0.4 carry the fix
F5 BIG-IP is affected by PHP2Shell: fixes are in 17.1.3.7, 17.5.1.11 and 21.1.0.4; APM data plane and TMUI exposed
Defender actions
- Update every F5 BIG-IP on 17.1, 17.5 or 21.1 to 17.1.3.7, 17.5.1.11 or 21.1.0.4, systems that publish an APM or SSL Orchestrator access profile first, because NCSC-NL records the access-profile data plane as exposed as well as the Configuration utility.
Analysis
F5's release notes for BIG-IP 17.1.3.7, 21.1.0.4 and 17.5.1.11, each updated on 2026-10-24, list K000163821 as the reference for the fix of the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 and describe each build as a critical release whose only new changes are PHP vulnerability fixes and which is cumulative and includes earlier hardened and critical releases (F5, 2026-10-24; F5, 2026-10-24; F5, 2026-10-24). NCSC-NL records F5 as confirming that BIG-IP 17.1.0 to 17.1.3, 17.5.0 to 17.5.1 and 21.1.0 are vulnerable through the Configuration utility control plane in all modules and, for APM and SSL Orchestrator, through the access-profile data plane, and that earlier affected releases stay vulnerable until updated (NCSC-NL, 2026-10-26). CISA lists both PHP flaws as exploited since 2026-10-26; nothing found reports an attack on BIG-IP (CISA KEV, 2026-10-28).
Cited evidence
The only new changes in this release are PHP vulnerability fixes.
F5 K000163821, updated 2026-10-24, lists fixes in 17.1.3.7, 17.5.1.11 and 21.1.0.4 for both CVEs.
Sources5
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.