PHP2Shell Does Not Impact Plume

You may have seen recent news about a serious security vulnerability affecting PHP. Security is a top priority in how we run our platform, and we act immediately when an issue like this arises. We want to share what we found.

PHP is a programming language widely used to build websites and web applications. Many company websites, customer portals and internal tools around the world run on it.

Plume services and Plume device firmware are not affected. No action or patch is required for any Plume product.

Details of two critical PHP flaws, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), became public in October 2026. The PHP project released fixes on 21 October 2026. Both flaws carry a severity score of 9.2 out of 10 (CVSS v4.0, Critical) assessed by the PHP project’s advisory team.

In simple terms, an attacker could send a specially crafted request to a website running a vulnerable version of PHP and take control of the server without logging in. These attacks can be hard to spot because the website keeps working normally.

Fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier have no official fix release date and should be moved to a supported version. Systems that do not run PHP are not affected.

As soon as the vulnerability was disclosed, our Information Security team launched a full review across the Plume environment. They confirmed that:

• No PHP is present on Plume’s internet-facing web servers, including production, verified through our asset inventory and a live sweep
• Plume Cloud services, including the WorkPass captive portal and public WiFi platform, are not built on PHP
• Our container and cloud workloads show no PHP components affected by these flaws
• Plume’s OpenSync device software does not use PHP
• The Plume mobile apps run on your subscribers’ phones and are not exposed to this vulnerability, and their backend services run in Plume Cloud

Because Plume does not use PHP in these areas, there is nothing to patch and nothing for you to change. As an additional safeguard, our endpoint protection continuously monitors for attacker activity linked to these vulnerabilities. We have detected no indicators of exploitation.

Some risks can exist outside the Plume products and interfaces you use. Thus, we encourage you to confirm the following:

• Third-party gateway firmware: If you operate gateways running third-party (ODM) firmware, please confirm with the vendor that any PHP components are updated to a fixed version. We are also engaging our ODM partners to confirm whether their firmware uses PHP. That review is still in progress. We will share an update once the review is complete.
• Self-hosted captive portals: If you run your own guest sign-in server rather than Plume’s, please confirm with your vendor or IT team that it is patched.
• Your wider IT estate: Websites, portals and internal tools commonly run on PHP and are worth checking, independently of Plume.

We will keep you informed as we review partner firmware. If you have any questions, please contact your Plume Customer Success representative or email infosec@plume.com.

Thank you for your continued trust.