Barracuda Networks, Inc.
- Aliases / services
- Barracuda Networks / Barracuda Networks, Inc. / Barracuda WAF / Barracuda WAF-as-a-Service / barracuda.com
- Official website
- https://www.barracuda.com
Sources identifying the operating company
US company Barracuda Networks, Inc., distinct from unrelated namesake entities.
Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.
Response status by service
Barracuda Web Application Firewall
- Response status
- Product not affected; PHP mitigation guidance available
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
WAF and cloud security.
The official matrix marks WAF itself not affected. PHP protection guidance covers blocking mode, request limits and custom configuration for CVE-2026-109619.
Scope: WAF product exposure differs from origin PHP exposure. Mitigations are incomplete and may affect legitimate large uploads.
What users should do
Apply and test the documented controls for relevant PHP traffic, and patch the origin PHP runtime.
Official service URL
Source URLs
- PHP2Shell response and scopehttps://blog.barracuda.com/2026/10/23/php2shell-php-exposure-waf-mitigationResponse evidence
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
- https://documentation.campus.barracuda.com/wiki/spaces/BWAFv76/pages/943620097/PHP%2BVulnerability%2BMitigation%2BCVE-2026-109618%2BCVE-2026-109619https://documentation.campus.barracuda.com/wiki/spaces/BWAFv76/pages/943620097/PHP%2BVulnerability%2BMitigation%2BCVE-2026-109618%2BCVE-2026-109619Response evidence
Barracuda Advanced Threat Protection
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Advanced Threat Protection not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda BarracudaONE
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks BarracudaONE not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Cloud Archiving Service (BCAS)
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Cloud Archiving Service (BCAS) not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Cloud-to-Cloud Backup
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Cloud-to-Cloud Backup not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda CloudGen Access (ZTNA)
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks CloudGen Access (ZTNA) not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda CloudGen Firewall
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks CloudGen Firewall not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Content Shield
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Content Shield not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Data Inspector
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Data Inspector not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Email Security Gateway (ESG)
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Email Security Gateway (ESG) not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Email Threat Scanner
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Email Threat Scanner not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Incident Response & Impersonation Protection
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Incident Response & Impersonation Protection not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Managed XDR
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Managed XDR not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Message Archiver
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Message Archiver not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda RMM
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks RMM not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Vulnerability Manager
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Vulnerability Manager not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Active DDoS Protection
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Active DDoS Protection not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Load Balancer ADC
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Load Balancer ADC not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda WAF Control Center
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks WAF Control Center not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Web Security Gateway / Web Security Agent
- Response status
- Not affected by these PHP vulnerabilities
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Barracuda's official product matrix marks Web Security Gateway / Web Security Agent not affected by CVE-2026-109618 and CVE-2026-109619.
Scope: This is the named product's assessment, not a blanket verdict for other products or protected servers.
What users should do
No PHP remediation action is specified for this product; assess other PHP environments with their providers.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Backup Service (BBS)
- Response status
- Remediated; no customer action
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official matrix marks Backup Service (BBS) remediated and says no action is needed.
Scope: The matrix does not disclose PHP versions or the implementation; remediation is not presented as confirmation of a particular patch.
What users should do
No additional customer action is required for this issue.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Campus
- Response status
- Remediated; no customer action
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official matrix marks Campus remediated and says no action is needed.
Scope: The matrix does not disclose PHP versions or the implementation; remediation is not presented as confirmation of a particular patch.
What users should do
No additional customer action is required for this issue.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Cloud Control (Barracuda Appliance Control)
- Response status
- Remediated; no customer action
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official matrix marks Cloud Control (Barracuda Appliance Control) remediated and says no action is needed.
Scope: The matrix does not disclose PHP versions or the implementation; remediation is not presented as confirmation of a particular patch.
What users should do
No additional customer action is required for this issue.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda MSP / Maestro
- Response status
- Remediated; no customer action
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official matrix marks MSP / Maestro remediated and says no action is needed.
Scope: The matrix does not disclose PHP versions or the implementation; remediation is not presented as confirmation of a particular patch.
What users should do
No additional customer action is required for this issue.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Security Awareness Training
- Response status
- Remediated; no customer action
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official matrix marks Security Awareness Training remediated and says no action is needed.
Scope: The matrix does not disclose PHP versions or the implementation; remediation is not presented as confirmation of a particular patch.
What users should do
No additional customer action is required for this issue.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Managed Security Awareness Training
- Response status
- Remediated; no customer action
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official matrix marks Managed Security Awareness Training remediated and says no action is needed.
Scope: The matrix does not disclose PHP versions or the implementation; remediation is not presented as confirmation of a particular patch.
What users should do
No additional customer action is required for this issue.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Backup Service Appliance
- Response status
- Remediation in progress
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The product matrix lists remediation in progress and asks customers to apply the patch promptly once available.
Scope: This differs from the remediated cloud Backup Service (BBS).
What users should do
Monitor the advisory and apply the patch when released.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
Barracuda Firewall Insights
- Response status
- Patch released; customer installation required
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The product matrix says a patch is released and directs users to apply the firmware update in the Firewall Insights web interface.
Scope: Patch availability does not confirm installation on each customer's system.
What users should do
Download the update under ADVANCED > Firmware Updates, then select Apply Now.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
- https://documentation.campus.barracuda.com/wiki/spaces/BFI/pages/2981970/Firmware%2BUpdateshttps://documentation.campus.barracuda.com/wiki/spaces/BFI/pages/2981970/Firmware%2BUpdatesService and operation documentation
Barracuda SecureEdge
- Response status
- PHP Hotfix 1176 released
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The 10.5.1 release notes say Hotfix 1176 updates PHP to 8.0.30-8.el9_8.1 and fixes both CVEs.
Scope: This confirms patch availability, not completed installation on every customer appliance.
What users should do
Apply the patch immediately or configure Auto Update for prompt installation; plan for any required restart.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
- https://documentation.campus.barracuda.com/wiki/spaces/SEPPI/pages/755859485/10.5.1%2BRelease%2BNoteshttps://documentation.campus.barracuda.com/wiki/spaces/SEPPI/pages/755859485/10.5.1%2BRelease%2BNotesResponse evidence
- https://documentation.campus.barracuda.com/wiki/spaces/SEP/pages/207094786/Updateshttps://documentation.campus.barracuda.com/wiki/spaces/SEP/pages/207094786/UpdatesService and operation documentation
Barracuda WAF-as-a-Service
- Response status
- Product not affected; known-path mitigation applied
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The matrix marks the service itself not affected. The blog says mitigation for the known CVE-2026-109619 path was automatically applied; request-limit protection requires blocking mode.
Scope: Cloud WAF mitigation is not a complete fix for the PHP runtime.
What users should do
Verify blocking mode and application compatibility, and patch origin PHP.
Source URLs
- https://trust.barracuda.com/security/php-vulnerabilitieshttps://trust.barracuda.com/security/php-vulnerabilitiesResponse evidence
- PHP2Shell response and scopehttps://blog.barracuda.com/2026/10/23/php2shell-php-exposure-waf-mitigationResponse evidence
Related official sources
- PHP2Shell response and scopeOfficial notice
- Operating entityOfficial information directory
Comments