PHP Vulnerability Responses by Company

NetApp

Global cloud / infrastructure
Aliases / services
NetApp / NetApp Inc. / ONTAP / netapp.com
Official website
https://www.netapp.com

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

NetApp ONTAP 9

Response status
Fixes available; upgrade recommended
Response information checked
2026-10-24

Current re-audit: Source inaccessible; on hold · Research date: 2026-10-28

Storage and data management products.

The October 26 advisory confirms exposure to CVE-2026-109618 and lists fixed builds 9.14.1P18HF1, 9.15.1P20HF1, 9.16.1P16HF1, 9.17.1P11HF1, 9.18.1P8HF1 and 9.19.1P3HF1. Upgrading to a fix is preferred over the workaround.

Scope: ONTAP 9 is confirmed affected by CVE-2026-109618. PHP-jail restrictions do not mean unaffected. Detailed KB procedures require support sign-in.

Some official sources could not be retrieved. Reverification remains on hold and the previous verification date is retained.

What users should do

Upgrade to the fixed build for your release branch. If immediate upgrade is not possible, follow the official KB; reverse the workaround after upgrading as instructed.

Official service URL

Source URLs

  1. PHP2Shell response and scopehttps://security.netapp.com/advisory/NTAP-20261021-0021Response evidence
  2. https://kb.netapp.com/on-prem/ontap/Ontap_OS/OS-KBs/How_to_apply_ONTAP_workarounds_for_PHP2SHELL_vulnerabilitieshttps://kb.netapp.com/on-prem/ontap/Ontap_OS/OS-KBs/How_to_apply_ONTAP_workarounds_for_PHP2SHELL_vulnerabilitiesResponse evidence
  3. https://security.netapp.com/adv_api/advisory/NTAP-20261021-0021https://security.netapp.com/adv_api/advisory/NTAP-20261021-0021Service and operation documentation
Related official sources
  1. PHP2Shell response and scopeOfficial notice
  2. Operating entityOfficial information directory

Comments