PHP2Shell: status of beroNet products and services
Published
Last updated: 6 November 2026: gateway firmware 24.01.03 with the security fix is available.
On 21 October 2026, two critical vulnerabilities in the PHP scripting language were published, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619, PHP advisory GHSA-w8hw-w9fx-j79w). A specially crafted HTTP request can drive PHP into an out-of-memory condition and, in some configurations, execute code on the server without logging in. The vulnerabilities are being exploited actively, and the BSI has issued a warning.
PHP is part of the beroNet website, the beroCloud and the web interface of our gateways. This page sets out what we have done, where things stand, and what you should do.
At a glance
| Area | Status |
|---|---|
| Website www.beronet.com | Done. Moved to a static platform without PHP on 21 October |
| beroCloud | Done. Moved to a new, patched platform on 22 October |
| beroNet vSBC (beroNet-operated systems) | Done. Patched PHP installed on 21 October |
| beroNet gateways | Update available. Firmware 24.01.03, released 6 November. Gateways on older firmware need the update to 24.01 |
Website: moved and upgraded
Our previous website ran on WordPress with an older PHP version for which no fix will be released. On 21 October we switched PHP off on that server and, the same evening, moved www.beronet.com to its new platform: a static site delivered through a content delivery network. The new website runs no PHP, no database and no server-side code at all. The old server has been taken off the web.
Firmware images, tools and datasheets remain available at their usual addresses, so gateways that download updates or recovery files from our server work as before.
beroCloud: moved and upgraded
The move of the beroCloud to a new platform was planned for November and already prepared. Because of PHP2Shell we brought it forward: in the night to 22 October 2026 the beroCloud moved to a new server in a data centre in Germany, running a current operating system and a PHP version that contains the fix. The interruption lasted about 25 minutes.
- No action is required on your gateways. They reached the beroCloud at the same address automatically, and logins, devices, configurations and backups are unchanged.
- PHP on the previous system was blocked from the night of the move onwards and is no longer reachable from the internet. Our review of the previous system found no signs of a compromise.
- A small number of gateways have the old server address entered manually. We are contacting those customers directly.
beroNet vSBC
On the systems operated by beroNet, the virtual SBC was updated to the fixed PHP version
on 21 October, and new installation images include it. If you run a vSBC on your own
virtual machine, install the current operating system updates (on Ubuntu:
apt update && apt upgrade), which contain the fixed PHP packages.
beroNet gateways: not at risk from the known attack scenario
The web interface of our gateways also uses PHP, an older version that no longer receives updates from the PHP project. We have therefore fixed the issue in our own firmware (see next section). Based on our analysis so far, gateways installed as recommended are not at risk from the attack scenario known today, for these reasons:
- Different PHP mode. On the gateways, PHP runs as CGI: every request starts a fresh, short-lived process that ends with the request. The exploit confirmed in the advisory targets a different mode (Apache mod_php), in which PHP processes serve many requests in a row. The advisory does not report any exploit against CGI, and we are not aware of one.
- High attack effort. The advisory itself rates the attack complexity as high. An attacker needs direct access to the gateway’s web interface and many attempts.
- The web interface is not meant to face the internet. Gateways are normally installed in the internal or management network, behind a firewall. A web interface that cannot be reached from the internet cannot be attacked from it.
- No known incidents. We have no reports of beroNet gateways being attacked through PHP2Shell.
This assessment applies to gateways whose web interface is not reachable from the internet. If yours is, please follow the recommendations below now and install firmware 24.01.03. A web interface on the internet is a bad idea in any case, with or without PHP2Shell: a gateway is an embedded device, and a much larger machine can easily overload it with a flood of requests (DDoS) and take it out of service.
Gateway security update: firmware 24.01.03
On 6 November 2026 we released firmware 24.01.03 for our gateways. It closes the PHP2Shell vulnerability on the gateways and fixes further security issues in the web interface and the beroCloud connection. We recommend this update for all gateways.
The update:
- ends a request immediately and safely when memory runs out, instead of continuing with damaged memory. This is the same approach the official PHP fix takes.
- accepts file uploads only from logged-in users, and sets strict limits on request size and structure, so oversized or malformed requests are rejected before PHP processes them.
- requires a login for further parts of the web interface and hardens the web server and the beroCloud connection.
How to update:
- Download: appfs-24.01.03.tar.gz
- Release notes with all changes and update notes: Changelog beroNet OS (Gateways)
- Gateways running 24.01.01 or 24.01.02 can be updated directly, through the firmware update in the web interface or through the beroCloud. The configuration is kept; the gateway restarts once.
- There is no separate patch for older firmware versions (20.x, 21.x, 23.x). These gateways need to be updated to 24.01. Please follow the notes on the update path in the release notes, or contact our support if you need help.
- If you use add-on apps that provide their own shell scripts as web pages, please contact our support before updating (see release notes).
- Check the time zone after updating from 23.01 or older. After such an update the configured time zone may be lost and the gateway runs on UTC (times in logs, CDR and caller ID; time-based routing is not affected). Under Preferences > Time Settings, select the time zone and timezone mode, save and activate; the setting is then kept. With manual time (GMT offset), no time source or time from ISDN this does not persist; please switch to the time zone setting. A fix will follow with one of the next updates.
What you should do now
Independent of PHP2Shell, these measures are good practice for every device on the network:
- Do not expose the web interface (HTTP/HTTPS) or SSH to the internet. Remove any port forwarding or firewall rule that makes the gateway reachable from outside.
- For remote access, use a VPN or a firewall rule that allows only known source addresses. For monitoring, updates and configuration you can use the beroCloud: the device only opens an outgoing connection, no inbound port is needed.
- Keep the management interface in a separate network (management VLAN), reachable only by the people who administer the device.
- Use strong, individual passwords for all accounts on the device and change any default passwords.
- Install firmware 24.01.03. Gateways managed through the beroCloud can be updated there.
Questions and reports
If you have questions about your installation, please contact our support. Security reports go to security@beronet.com.