PHP Vulnerability Responses by Company

Netwrix Corporation

Global cloud / infrastructure
Aliases / services
Netwrix / Netwrix Corporation / Endpoint Protector / CoSoSys / Stealthbits / Imanami / Usercube / netwrix.com
Official website
https://netwrix.com
Sources identifying the operating company

Official website operator or publisher; check the individual contract for the product and regional contracting entity.

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Netwrix Endpoint Protector SaaS

Response status
SaaS patched
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Data protection and Endpoint Protector.

The 27 October update to ADV-2026-021 confirms SaaS remediation with no customer action.

Scope: Endpoint Protector SaaS only; on-premises upgrades are separate.

What users should do

No customer-side SaaS update is required.

Official service URL

Source URLs

  1. PHP2Shell response and scopehttps://community.netwrix.com/t/adv-2026-021-php-runtime-vulnerabilities-in-netwrix-endpoint-protector/161687Response evidence
  2. https://community.netwrix.com/c/endpoint-protector/security-advisories/202https://community.netwrix.com/c/endpoint-protector/security-advisories/202Service and operation documentation
  3. https://docs.netwrix.com/docs/endpointprotector/admin/systemconfiguration/overview#security-updateshttps://docs.netwrix.com/docs/endpointprotector/admin/systemconfiguration/overview#security-updatesService and operation documentation
  4. https://community.netwrix.com/t/php2shell-on-epp-servers-test-results-show-legacy-versions/161786/2https://community.netwrix.com/t/php2shell-on-epp-servers-test-results-show-legacy-versions/161786/2Service and operation documentation
  5. Operating entityhttps://community.netwrix.com/tosService and operation documentation

Endpoint Protector 2608 on premises

Response status
Backend security update required
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Existing 2608 deployments require backend security updates; appliances downloaded since 26 October are reported to include the fix.

Scope: Do not infer remediation solely from the 2608 name or displayed PHP version.

What users should do

Back up/test, apply updates through the web UI and verify; do not use OS CLI updates.

Source URLs

  1. PHP2Shell response and scopehttps://community.netwrix.com/t/adv-2026-021-php-runtime-vulnerabilities-in-netwrix-endpoint-protector/161687Response evidence
  2. https://community.netwrix.com/c/endpoint-protector/security-advisories/202https://community.netwrix.com/c/endpoint-protector/security-advisories/202Service and operation documentation
  3. https://docs.netwrix.com/docs/endpointprotector/admin/systemconfiguration/overview#security-updateshttps://docs.netwrix.com/docs/endpointprotector/admin/systemconfiguration/overview#security-updatesService and operation documentation
  4. https://community.netwrix.com/t/php2shell-on-epp-servers-test-results-show-legacy-versions/161786/2https://community.netwrix.com/t/php2shell-on-epp-servers-test-results-show-legacy-versions/161786/2Service and operation documentation
  5. Operating entityhttps://community.netwrix.com/tosService and operation documentation

Older Endpoint Protector on-premises versions

Response status
Migrate to 2608; interim updates needed
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Older releases should migrate to 2608 and apply backend security updates until migration is complete.

Scope: This is not assurance that continued legacy-version use is safe.

What users should do

Confirm upgrade eligibility and migration steps with Netwrix.

Source URLs

  1. PHP2Shell response and scopehttps://community.netwrix.com/t/adv-2026-021-php-runtime-vulnerabilities-in-netwrix-endpoint-protector/161687Response evidence
  2. https://community.netwrix.com/c/endpoint-protector/security-advisories/202https://community.netwrix.com/c/endpoint-protector/security-advisories/202Service and operation documentation
  3. https://docs.netwrix.com/docs/endpointprotector/admin/systemconfiguration/overview#security-updateshttps://docs.netwrix.com/docs/endpointprotector/admin/systemconfiguration/overview#security-updatesService and operation documentation
  4. https://community.netwrix.com/t/php2shell-on-epp-servers-test-results-show-legacy-versions/161786/2https://community.netwrix.com/t/php2shell-on-epp-servers-test-results-show-legacy-versions/161786/2Service and operation documentation
  5. Operating entityhttps://community.netwrix.com/tosService and operation documentation

Netwrix products other than Endpoint Protector

Response status
Other products reported unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The advisory identifies Endpoint Protector as the only affected Netwrix product.

Scope: Portfolio assessment for this advisory, not assurance against unrelated vulnerabilities.

What users should do

Check Endpoint Protector separately if also deployed.

Source URLs

  1. PHP2Shell response and scopehttps://community.netwrix.com/t/adv-2026-021-php-runtime-vulnerabilities-in-netwrix-endpoint-protector/161687Response evidence
  2. https://community.netwrix.com/c/endpoint-protector/security-advisories/202https://community.netwrix.com/c/endpoint-protector/security-advisories/202Service and operation documentation
  3. https://docs.netwrix.com/docs/endpointprotector/admin/systemconfiguration/overview#security-updateshttps://docs.netwrix.com/docs/endpointprotector/admin/systemconfiguration/overview#security-updatesService and operation documentation
  4. https://community.netwrix.com/t/php2shell-on-epp-servers-test-results-show-legacy-versions/161786/2https://community.netwrix.com/t/php2shell-on-epp-servers-test-results-show-legacy-versions/161786/2Service and operation documentation
  5. Operating entityhttps://community.netwrix.com/tosService and operation documentation
Related official sources
  1. PHP2Shell response and scopeOfficial notice
  2. Backup and web-interface update instructionsOfficial notice
  3. Operating entityOfficial information directory

Comments