PHP Vulnerability Responses by Company

Nethesis

Global cloud / infrastructure
Aliases / services
NethServer / NethServer 8 / NethVoice / Piler / ネテシス / Nethesis
Official website
https://www.nethesis.it/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

NethServer 8 Webserver

Response status
Patches available; legacy PHP mitigated only
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Provider of NethServer and business server products.

Webserver 1.4.3 provides patched PHP 8.2–8.5. PHP 7.4, 8.0 and 8.1 receive mitigations only, which custom pool settings may override.

Scope: Limited to the NethServer 8 Webserver module. Other NS8 apps and NethServer 7 require separate checks. Release availability does not confirm installation.

What users should do

Update Webserver and verify each site's PHP version and effective pool settings. Migrate legacy PHP to a patched supported branch.

Official service URL

Source URLs

  1. NethServer PHP fixes and mitigationshttps://github.com/NethServer/dev/issues/8256Response evidence
  2. https://github.com/NethServer/ns8-webserver/releases/tag/1.4.3https://github.com/NethServer/ns8-webserver/releases/tag/1.4.3Service and operation documentation

NethServer 8 Piler

Response status
Patch available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official Piler 1.3.2 release provides a PHP2Shell fix. Piler uses Ubuntu PHP8.5.4-0ubuntu1.5 with backported fixes; the upstream version alone is insufficient.

Scope: Limited to this module distributed by NethServer8. Release availability does not confirm installation in every environment and does not cover other upstream deployments.

What users should do

Update the relevant NS8 module to the fixed release and verify the running module/container and its functions.

Source URLs

  1. https://github.com/NethServer/ns8-piler/releases/tag/1.3.2https://github.com/NethServer/ns8-piler/releases/tag/1.3.2Response evidence
  2. https://github.com/NethServer/dev/issues/8256#issuecomment-6365050743https://github.com/NethServer/dev/issues/8256#issuecomment-6365050743Service and operation documentation

NethServer 8 Nextcloud

Response status
Patch available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official Nextcloud 1.7.8 release provides a PHP2Shell fix.

Scope: Limited to this module distributed by NethServer8. Release availability does not confirm installation in every environment and does not cover other upstream deployments.

What users should do

Update the relevant NS8 module to the fixed release and verify the running module/container and its functions.

Source URLs

  1. https://github.com/NethServer/ns8-nextcloud/releases/tag/1.7.8https://github.com/NethServer/ns8-nextcloud/releases/tag/1.7.8Response evidence

NethServer 8 Roundcube

Response status
Patch available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official Roundcube 2.2.2 release provides a PHP2Shell fix.

Scope: Limited to this module distributed by NethServer8. Release availability does not confirm installation in every environment and does not cover other upstream deployments.

What users should do

Update the relevant NS8 module to the fixed release and verify the running module/container and its functions.

Source URLs

  1. https://github.com/NethServer/ns8-roundcubemail/releases/tag/2.2.2https://github.com/NethServer/ns8-roundcubemail/releases/tag/2.2.2Response evidence

NethServer 8 Porthos

Response status
Patch available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official Porthos 1.7.1 release provides a PHP2Shell fix.

Scope: Limited to this module distributed by NethServer8. Release availability does not confirm installation in every environment and does not cover other upstream deployments.

What users should do

Update the relevant NS8 module to the fixed release and verify the running module/container and its functions.

Source URLs

  1. https://github.com/NethServer/ns8-porthos/releases/tag/1.7.1https://github.com/NethServer/ns8-porthos/releases/tag/1.7.1Response evidence
  2. https://github.com/NethServer/dev/issues/8256#issuecomment-6334935507https://github.com/NethServer/dev/issues/8256#issuecomment-6334935507Service and operation documentation

NethServer 8 WordPress

Response status
Patch available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official WordPress 1.2.7 release provides a PHP2Shell fix.

Scope: Limited to this module distributed by NethServer8. Release availability does not confirm installation in every environment and does not cover other upstream deployments.

What users should do

Update the relevant NS8 module to the fixed release and verify the running module/container and its functions.

Source URLs

  1. https://github.com/NethServer/ns8-wordpress/releases/tag/1.2.7https://github.com/NethServer/ns8-wordpress/releases/tag/1.2.7Response evidence

NethServer 8 Passbolt

Response status
Patch available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official Passbolt 1.1.1 release provides a PHP2Shell fix.

Scope: Limited to this module distributed by NethServer8. Release availability does not confirm installation in every environment and does not cover other upstream deployments.

What users should do

Update the relevant NS8 module to the fixed release and verify the running module/container and its functions.

Source URLs

  1. https://github.com/NethServer/ns8-passbolt/releases/tag/1.1.1https://github.com/NethServer/ns8-passbolt/releases/tag/1.1.1Response evidence

NethServer 8 DokuWiki

Response status
Patch available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official DokuWiki 1.2.1 release provides a PHP2Shell fix.

Scope: Limited to this module distributed by NethServer8. Release availability does not confirm installation in every environment and does not cover other upstream deployments.

What users should do

Update the relevant NS8 module to the fixed release and verify the running module/container and its functions.

Source URLs

  1. https://github.com/NethServer/ns8-dokuwiki/releases/tag/1.2.1https://github.com/NethServer/ns8-dokuwiki/releases/tag/1.2.1Response evidence

NethServer 8 MariaDB / phpMyAdmin

Response status
Patch available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The official MariaDB / phpMyAdmin 1.2.2 release provides a PHP2Shell fix. The affected component is the phpMyAdmin administration image; the later1.2.2 release was verified.

Scope: Limited to this module distributed by NethServer8. Release availability does not confirm installation in every environment and does not cover other upstream deployments.

What users should do

Update the relevant NS8 module to the fixed release and verify the running module/container and its functions.

Source URLs

  1. https://github.com/NethServer/ns8-mariadb/releases/tag/1.2.2https://github.com/NethServer/ns8-mariadb/releases/tag/1.2.2Response evidence

NethServer 8 LAMP

Response status
Update available; verify PHP branch
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

LAMP1.4.2 publishes a PHP2Shell update. Official tracking confirms patched PHP8.2–8.5; this finding does not classify all legacy branches as patched.

Scope: NethServer8 LAMP module only. Coverage differs by PHP branch; a module update alone is not proof that every branch is fixed.

What users should do

Update LAMP and verify the selected PHP branch and full package revision. Migrate legacy workloads to a patched branch.

Source URLs

  1. https://github.com/NethServer/ns8-lamp/releases/tag/1.4.2https://github.com/NethServer/ns8-lamp/releases/tag/1.4.2Response evidence
  2. NethServer PHP fixes and mitigationshttps://github.com/NethServer/dev/issues/8256Response evidence

NethServer 8 WebTop

Response status
Mitigation available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

WebTop1.5.16 provides mitigation. WebDAV/Z-Push still use PHP7.3; this is not a completed PHP runtime fix.

Scope: NethServer8 WebTop module only. Do not conflate the PHP7.3 WebDAV/Z-Push components with phonebook tasks using a different PHP runtime.

What users should do

Update WebTop, monitor subsequent vendor fixes and verify affected functions. Do not treat mitigation as a permanent fix.

Source URLs

  1. https://github.com/NethServer/ns8-webtop/releases/tag/1.5.16https://github.com/NethServer/ns8-webtop/releases/tag/1.5.16Response evidence
  2. https://github.com/NethServer/dev/issues/8256#issuecomment-6335952936https://github.com/NethServer/dev/issues/8256#issuecomment-6335952936Service and operation documentation

NethServer 7 legacy PHP / Tancredi

Response status
Mitigation only; migration required
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

NethServer7 receives mitigations. nethserver-php1.3.1 and Tancredi1.18.2 releases were verified, but legacy PHP runtimes are not classified as patched.

Scope: Limited to legacy NethServer7. NS8 patched releases do not establish NS7 remediation.

What users should do

Apply relevant mitigation updates from the designated repositories and migrate to a patched NethServer8 configuration.

Source URLs

  1. NethServer PHP fixes and mitigationshttps://github.com/NethServer/dev/issues/8256Response evidence
  2. https://github.com/NethServer/dev/issues/8256#issuecomment-6338185156https://github.com/NethServer/dev/issues/8256#issuecomment-6338185156Service and operation documentation
  3. https://github.com/NethServer/dev/issues/8256#issuecomment-6359146835https://github.com/NethServer/dev/issues/8256#issuecomment-6359146835Service and operation documentation
Related official sources
  1. NethServer PHP fixes and mitigationsOfficial notice

Comments