Ctrl IQ Inc.
- Aliases / services
- CIQ / Ctrl IQ Inc. / RLC Pro / RLC Pro LTS / CIQ Bridge / ciq.com
- Official website
- https://ciq.com
Sources identifying the operating company
Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.
Response status by service
RLC Pro10 (10.2)
- Response status
- Fixed PHP packages available
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Enterprise Linux distributions and long-term support.
Default PHP8.3.36-1.el10_2 and php8.4-8.4.27-1.el10_2 are available and were installed and checked by CIQ on October27.
Scope: Applies to RLC Pro10.2. Other Pro,LTS,Hardened,FIPS and Bridge variants have different versions and unfixed streams.
What users should do
Update the applicable PHP packages, restart affected services and verify installation.
Official service URL
Source URLs
- PHP2Shell response and scopehttps://kb.ciq.com/article/security-advisories/cve-php2shell-mitigationResponse evidence
- Operating entityhttps://ciq.com/legal/terms-and-conditionsService and operation documentation
RLC Pro 9
- Response status
- Fixed packages available; check variant and stream
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official table lists fixed builds 8.0.30-8.el9_8.1 / 8.2.35-1 / 8.3.36-1. Requires9.8 repositories;9.7 repositories receive no fix and PHP8.1 is unpatched.
Scope: Package availability does not mean customer deployment is complete. Scope follows the October27 table.
What users should do
Use the appropriate stream and repository, update PHP, restart affected services and verify installation.
Source URLs
- PHP2Shell response and scopehttps://kb.ciq.com/article/security-advisories/cve-php2shell-mitigationResponse evidence
- Operating entityhttps://ciq.com/legal/terms-and-conditionsService and operation documentation
RLC Pro 8（8.10）
- Response status
- Fixed packages available; check variant and stream
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official table lists fixed builds 7.4.33-8 / 8.2.35-1. Default7.2,7.3 and8.0 streams are unpatched; switch to7.4 or8.2.
Scope: Package availability does not mean customer deployment is complete. Scope follows the October27 table.
What users should do
Use the appropriate stream and repository, update PHP, restart affected services and verify installation.
Source URLs
- PHP2Shell response and scopehttps://kb.ciq.com/article/security-advisories/cve-php2shell-mitigationResponse evidence
- Operating entityhttps://ciq.com/legal/terms-and-conditionsService and operation documentation
RLC Pro LTS 10.2
- Response status
- Fixed packages available; check variant and stream
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official table lists fixed builds 8.3.36-1.el10_2 / php8.4-8.4.27-1.el10_2. Uses the same AppStream as Pro10.2; CIQ could not deploy this LTS variant for its test.
Scope: Package availability does not mean customer deployment is complete. Scope follows the October27 table.
What users should do
Use the appropriate stream and repository, update PHP, restart affected services and verify installation.
Source URLs
- PHP2Shell response and scopehttps://kb.ciq.com/article/security-advisories/cve-php2shell-mitigationResponse evidence
- Operating entityhttps://ciq.com/legal/terms-and-conditionsService and operation documentation
RLC Pro LTS 8.6
- Response status
- Fixed packages available; check variant and stream
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official table lists fixed builds 7.4.33-8 / 8.2.35-1. No planned fixes for7.2,7.3 or8.0; switch to7.4 or8.2.
Scope: Package availability does not mean customer deployment is complete. Scope follows the October27 table.
What users should do
Use the appropriate stream and repository, update PHP, restart affected services and verify installation.
Source URLs
- PHP2Shell response and scopehttps://kb.ciq.com/article/security-advisories/cve-php2shell-mitigationResponse evidence
- Operating entityhttps://ciq.com/legal/terms-and-conditionsService and operation documentation
RLC Pro LTS 8.10
- Response status
- Fixed packages available; check variant and stream
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official table lists fixed builds 7.4.33-8 / 8.2.35-1. Same builds as Pro8.10;7.2,7.3 and8.0 are unpatched, so switch to7.4 or8.2.
Scope: Package availability does not mean customer deployment is complete. Scope follows the October27 table.
What users should do
Use the appropriate stream and repository, update PHP, restart affected services and verify installation.
Source URLs
- PHP2Shell response and scopehttps://kb.ciq.com/article/security-advisories/cve-php2shell-mitigationResponse evidence
- Operating entityhttps://ciq.com/legal/terms-and-conditionsService and operation documentation
RLC Pro LTS 9.2
- Response status
- Fixed packages available; check variant and stream
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official table lists fixed builds 8.0.30-1.2.el9_2_ciq / 8.2.35-1 / 8.3.36-1. PHP8.1 has no planned fix; switch to8.2 or8.3.
Scope: Package availability does not mean customer deployment is complete. Scope follows the October27 table.
What users should do
Use the appropriate stream and repository, update PHP, restart affected services and verify installation.
Source URLs
- PHP2Shell response and scopehttps://kb.ciq.com/article/security-advisories/cve-php2shell-mitigationResponse evidence
- Operating entityhttps://ciq.com/legal/terms-and-conditionsService and operation documentation
RLC Pro LTS 9.6
- Response status
- Fixed packages available; check variant and stream
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official table lists fixed builds 8.0.30-3.4.el9_6_ciq / 8.2.35-1 / 8.3.36-1. PHP8.1 has no planned fix; switch to8.2 or8.3.
Scope: Package availability does not mean customer deployment is complete. Scope follows the October27 table.
What users should do
Use the appropriate stream and repository, update PHP, restart affected services and verify installation.
Source URLs
- PHP2Shell response and scopehttps://kb.ciq.com/article/security-advisories/cve-php2shell-mitigationResponse evidence
- Operating entityhttps://ciq.com/legal/terms-and-conditionsService and operation documentation
RLC Pro Hardened 9.6 LTS
- Response status
- Fixed packages available; check variant and stream
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official table lists fixed builds 8.0.30-3.4.el9_6_ciq / 8.2.35-1 / 8.3.36-1. Uses LTS9.6 builds; PHP8.1 has no planned fix, so switch to8.2 or8.3.
Scope: Package availability does not mean customer deployment is complete. Scope follows the October27 table.
What users should do
Use the appropriate stream and repository, update PHP, restart affected services and verify installation.
Source URLs
- PHP2Shell response and scopehttps://kb.ciq.com/article/security-advisories/cve-php2shell-mitigationResponse evidence
- Operating entityhttps://ciq.com/legal/terms-and-conditionsService and operation documentation
RLC Pro Hardened 9.7・9.8
- Response status
- Fixed packages available; check variant and stream
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official table lists fixed builds 8.0.30-8.el9_8.1 / 8.2.35-1 / 8.3.36-1. Hardened9.7 using rolling rlc-9 receives9.8 builds. PHP8.1 is unpatched; switch to8.2 or8.3.
Scope: Package availability does not mean customer deployment is complete. Scope follows the October27 table.
What users should do
Use the appropriate stream and repository, update PHP, restart affected services and verify installation.
Source URLs
- PHP2Shell response and scopehttps://kb.ciq.com/article/security-advisories/cve-php2shell-mitigationResponse evidence
- Operating entityhttps://ciq.com/legal/terms-and-conditionsService and operation documentation
RLC Pro FIPS 9.6
- Response status
- Fixed packages available; check variant and stream
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official table lists fixed builds 8.0.30-3.4.el9_6_ciq / 8.2.35-1 / 8.3.36-1. PHP comes from LTS9.6 repositories. PHP8.1 has no planned fix; switch to8.2 or8.3.
Scope: Package availability does not mean customer deployment is complete. Scope follows the October27 table.
What users should do
Use the appropriate stream and repository, update PHP, restart affected services and verify installation.
Source URLs
- PHP2Shell response and scopehttps://kb.ciq.com/article/security-advisories/cve-php2shell-mitigationResponse evidence
- Operating entityhttps://ciq.com/legal/terms-and-conditionsService and operation documentation
CIQ Bridge（CentOS 7.9）
- Response status
- Fixed packages available; check variant and stream
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The official table lists fixed builds 5.4.45-1.2.el7_9.ciqcbr. Applies to CIQ Bridge repositories, not arbitrary CentOS packages.
Scope: Package availability does not mean customer deployment is complete. Scope follows the October27 table.
What users should do
Use the appropriate stream and repository, update PHP, restart affected services and verify installation.
Source URLs
- PHP2Shell response and scopehttps://kb.ciq.com/article/security-advisories/cve-php2shell-mitigationResponse evidence
- Operating entityhttps://ciq.com/legal/terms-and-conditionsService and operation documentation
Related official sources
- PHP2Shell response and scopeOfficial notice
- Operating entityOfficial information directory
Comments