PHP Vulnerability Responses by Company

Citrix

Global cloud / infrastructure
Aliases / services
Citrix / Citrix Systems / NetScaler / Citrix Cloud / Cloud Software Group / citrix.com
Official website
https://www.citrix.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

NetScaler ADC and Gateway

Response status
Fixed builds available; customer upgrade required
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Virtual desktops and application delivery.

The October 27 update lists 14.1-73.49+, 13.1-64.32+ and dedicated FIPS/NDcPP fixed builds.

Scope: PHP-based NetScaler management interfaces. Backend-application WAF signatures do not replace management-plane remediation.

What users should do

Install the appropriate fixed build and restrict GUI/API access on NSIP, management-enabled SNIPs and Cluster IP to trusted administrative networks.

Official service URL

Source URLs

  1. https://support.citrix.com/external/article/CTX697263/citrix-security-advisory-for-cve20261096.htmlhttps://support.citrix.com/external/article/CTX697263/citrix-security-advisory-for-cve20261096.htmlResponse evidence
  2. https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/Service and operation documentation

Citrix-managed cloud services

Response status
Cloud-side response complete
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Citrix states both CVEs have been addressed in its managed cloud services and customers need no action. The implementation method is unspecified.

Scope: Only Citrix-managed cloud services; customer-operated on-premises products such as NetScaler require separate action.

What users should do

No customer action is required for this cloud response.

Source URLs

  1. https://support.citrix.com/external/article/CTX697263/citrix-security-advisory-for-cve20261096.htmlhttps://support.citrix.com/external/article/CTX697263/citrix-security-advisory-for-cve20261096.htmlResponse evidence
  2. https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/Service and operation documentation
Related official sources
  1. PHP2Shell response and scopeOfficial notice

Comments