N-able

Soluzioni per MSP e team IT

Sicurezza
Threat Research

N-able Update on the Global PHP Issue

By N-able

Ottobre 21st, 2026 3 mins

Content

Update: October 22, 2026, 18:30 PM EDT Update October 22, 2026 11 AM EDT Original post

Update: October 22, 2026, 18:30 PM EDT

As soon as we learned about the nature of the PHP vulnerabilities, we put mitigating rules and settings in place to keep our customers as safe as possible. As of October 22, 2026,18:30 PM EDT all of our relevant products have been secured against these vulnerabilities and their root causes. [These fixes cover all supported PHP versions on our platform, not just the latest releases.]

What to expect: The initial mitigations remain in place and will be removed once we are confident no further patches are planned. They are not invasive, but they may affect file upload forms.

Update October 22, 2026 11 AM EDT

  • We have completed patching for the following products:
    • Take Control – Integrated with N-central and N-sight. This is limited to Take Control Session routing and does not expand into other areas of the product.
    • N-sight
    • Mail Assure/Spam Experts
    • Passportal
    • *Take Control Standalone patching is nearly complete and we will update here when done.

All other products are not affected.

Original post

N-able is aware of and tracking the recently disclosed PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting organizations worldwide, and we are treating it as a priority.

What we’re doing right now:

  • We have declared emergency maintenance windows (uptime.n-able.com) for the following N-able products and updates are being applied in real time:
    • Take Control – Standalone and integrated with N-central and N-sight. This is limited to Take Control Session routing and does not expand into other areas of the product.
    • N-sight
    • Mail Assure / Spam Experts
    • Passportal

    All other products are not affected.

  • Compensating controls to help prevent exploit attempts and additional monitoring are already in place to help manage risks while more comprehensive fixes and updates are being applied.
  • We will update this post if we detect exploitation of these vulnerabilities. To date, we have not detected any exploitation within our product suite.
  • Follow the N-able blog for more information around PHP Foundation guidance and for information about our Adlumin MDR platform response: PHP Foundation issues unusual advance notice for security patches. Here’s what to know.
  • We will continue to provide updates throughout the day as we learn more. If you have questions or concerns in the meantime, please contact N-able Support: N-able Me.

Thank you for your patience and trust.