SonicWall
- Aliases / services
- SonicWall / SonicWall Inc. / SonicOS / SonicWave / sonicwall.com
- Official website
- https://www.sonicwall.com/
Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.
Response status by service
SonicOS
- Response status
- Initial assessment: no PHP
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
Firewall, remote access and network protection products.
PSIRT found no PHP use and no indication these CVEs apply.
Scope: Current assessment of this product only.
What users should do
Send contrary scanner findings to support.
Official service URL
Source URLs
- PHP2Shell response and scopehttps://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AGResponse evidence
SMA 1000 Series
- Response status
- Initial assessment: no PHP
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
PSIRT found no PHP use and no indication these CVEs apply.
Scope: Current assessment of this product only.
What users should do
Send contrary scanner findings to support.
Source URLs
- PHP2Shell response and scopehttps://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AGResponse evidence
Network Security Manager (NSM)
- Response status
- Initial assessment: no PHP
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
PSIRT found no PHP use and no indication these CVEs apply.
Scope: Current assessment of this product only.
What users should do
Send contrary scanner findings to support.
Source URLs
- PHP2Shell response and scopehttps://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AGResponse evidence
MySonicWall
- Response status
- Initial assessment: no PHP
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
PSIRT found no PHP use and no indication these CVEs apply.
Scope: Current assessment of this product only.
What users should do
Send contrary scanner findings to support.
Source URLs
- PHP2Shell response and scopehttps://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AGResponse evidence
Email Security
- Response status
- Initial assessment: no PHP
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
PSIRT found no PHP use and no indication these CVEs apply.
Scope: Current assessment of this product only.
What users should do
Send contrary scanner findings to support.
Source URLs
- PHP2Shell response and scopehttps://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AGResponse evidence
Cloud Secure Edge (CSE)
- Response status
- Initial assessment: no PHP
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
PSIRT found no PHP use and no indication these CVEs apply.
Scope: Current assessment of this product only.
What users should do
Send contrary scanner findings to support.
Source URLs
- PHP2Shell response and scopehttps://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AGResponse evidence
Unified Management (UM)
- Response status
- Initial assessment: no PHP
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
PSIRT found no PHP use and no indication these CVEs apply.
Scope: Current assessment of this product only.
What users should do
Send contrary scanner findings to support.
Source URLs
- PHP2Shell response and scopehttps://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AGResponse evidence
Wireless Network Manager (WNM)
- Response status
- Initial assessment: no PHP
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
PSIRT found no PHP use and no indication these CVEs apply.
Scope: Current assessment of this product only.
What users should do
Send contrary scanner findings to support.
Source URLs
- PHP2Shell response and scopehttps://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AGResponse evidence
SonicWall Switches
- Response status
- PSIRT impact evaluation underway
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The October 22 revision removed this product from the unaffected list and records ongoing PSIRT evaluation.
Scope: The eight-product unaffected assessment does not cover this product.
What users should do
Check support and later notices for your model.
Source URLs
- PHP2Shell response and scopehttps://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AGResponse evidence
SonicWave Access Points
- Response status
- PSIRT impact evaluation underway
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The October 22 revision removed this product from the unaffected list and records ongoing PSIRT evaluation.
Scope: The eight-product unaffected assessment does not cover this product.
What users should do
Check support and later notices for your model.
Source URLs
- PHP2Shell response and scopehttps://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AGResponse evidence
SonicWall IPS protection for PHP2Shell
- Response status
- IPS signatures released
- Response information checked
- 2026-10-28
Current re-audit: Official response verified · Research date: 2026-10-28
The notice lists IPS signatures 22573, 22565, 22566 and 4636.
Scope: Traffic protection, not a PHP fix or a guarantee against every attack.
What users should do
Update IPS and separately patch the protected PHP systems.
Source URLs
- PHP2Shell response and scopehttps://www.sonicwall.com/support/notices/product-notice-sonicwall-products-and-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619/kA1VN000002YKw10AGResponse evidence
Related official sources
- PHP2Shell response and scopeOfficial notice
Comments