On October 22, 2026, a Peplink security advisory disclosed two Peplink vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Both involve a PHP component. Most Peplink owners aren't exposed, but two setups are, and both now have a firmware fix. Here's who needs a Peplink firmware update and which file to install.
Are you affected?
| What you run | Affected? | Fix |
|---|---|---|
| InControl 2 (hosted by Peplink) | No | Nothing to do |
| InControl Virtual Appliance (ICVA) 2.14.3 or earlier | Yes, through the Control Panel on TCP port 4443 | Upgrade to ICVA firmware 2.14.4 |
| Balance or MAX on firmware 8.6.1 GA with Edge Computing (EC) enabled and running | Yes | Install special firmware 8.6.1s042 |
| Balance or MAX with Edge Computing turned off | No, per Peplink | Update when the next GA release ships |
Edge Computing is off by default, so a Balance or MAX router is only exposed if someone turned it on. If you aren't sure, check the router before deciding you're in the clear.
InControl Virtual Appliance: upgrade to 2.14.4
If you host your own InControl on an ICVA, the issue is in its Control Panel on port 4443. Firmware 2.14.4 is the permanent fix and is on Peplink's ICVA download page. Until you can upgrade, keep the Control Panel off the internet and allow port 4443 only from trusted networks, such as a management VLAN or a VPN.
Balance and MAX with Edge Computing: install 8.6.1s042
EC uses the affected PHP component. Peplink released special firmware 8.6.1s042 for EC-capable models, and the fix will also go into the next GA release.
If you can't update right away, Peplink recommends two steps:
- Turn off Web Admin access on the WAN side.
- If ContentHub is running, turn it off for now, or block inbound access to it from outside your network.
Models covered by 8.6.1s042
Peplink ships the special firmware as three files. Match your model and hardware revision before you load one.
| Firmware file | Models and hardware revisions |
|---|---|
| build6634 | B One HW1; B One 5G HW1-2; B One Plus HW1-2; Balance 310 HW5; Balance 310 5G HW3; Balance 580X HW2; MAX BR1 Pro 5G HW3; MAX BR2 Pro HW4-5; MAX Orbit 2, 4, and 8 HW1; MAX Transit Duo Pro HW1-3; MAX Transit Pro E HW2-3 |
| build6458 | Balance 1350 EC HW1; Balance 2500 EC HW1; Balance 310 5G HW1-2; Balance 310 Fiber 5G HW1-2; Balance 310X HW1-3; Balance 380X HW1; Balance 5000 EC (40G and 100G) HW1; Balance 580X HW1; EPX HW1; MAX HD2 MBX and HD4 MBX HW1-4; MAX MBX Mini HW1-2; PDX HW1-2; SDX HW1-4; SDX Pro HW2 |
| build5546 | MediaFast 500 HW1-2; MediaFast 750 HW1 |
Download links and the full details are in Peplink's security advisory.
Shopping for a router? See the Peplink routers we stock and why we recommend Peplink.
Need a hand?
If you run a Peplink router on Crosstalk Mobile and want help checking whether Edge Computing is on, or loading the right firmware file, call or text an engineer at 888-381-7750, Monday through Friday, 6:30 AM to 3:00 PM Pacific.
