Welcome to Pax8's Trust Center. We earn your trust by doing what we say we'll do and by being transparent with our customers and stakeholders, which is why we've provided our security, compliance, and privacy information in one, easy-to-access site.
Trust thrives in situations where everyone can win together. This is especially important for managed service providers (MSPs), because they are entrusted to protect the critical IT infrastructure and data of their clients. We recognize that our customers can only deliver on their promises when Pax8 operates as a trustworthy partner.
Pax8's security and privacy programs are led by industry veterans with decades of experience:
Robb Reck: Chief Trust & Security Officer
Carrie Schiff: Chief Legal Officer
Subprocessors
Trust Center Updates
Partner Security Intelligence Bulletin: Product Vulnerability Alert — PHP “PHP2Shell” (CVE-2026-109618 [Critical], CVE-2026-109619 [Critical])
The PHP project has released emergency security updates for two vulnerabilities in the PHP interpreter itself, collectively referred to as “PHP2Shell.” Both vulnerabilities allow an unauthenticated attacker to execute code remotely on a web server running PHP, with the privileges of the web server or PHP worker account. Pax8 rates both vulnerabilities as Critical, and affected system owners are urged to update immediately.
Because these flaws are in the PHP runtime rather than in application code, updating WordPress, Joomla, Drupal, Magento or other PHP applications and plugins does not resolve them. The underlying PHP installation must be updated.
What’s the issue?
CVE-2026-109618 [Critical] — Remote code execution via out-of-memory corruption. PHP’s out-of-memory handling can interrupt a request while internal data is only partially initialized. Request cleanup may then treat that invalid data as valid, which can be leveraged to execute code.
CVE-2026-109619 [Critical] — Remote code execution via stale global state. Internal request state can survive after its memory has been freed, and a later request handled by the same PHP worker may use it before it is reset. PHP lists the confirmed impact as use-after-free, memory disclosure and remote code execution. Memory disclosure alone may expose sensitive data from other requests processed by the same worker.
Current exploitation status: Following a public leak, the PHP project moved its coordinated disclosure forward one day and released fixes on October 21. watchTowr reports observing exploitation attempts against both vulnerabilities through its global honeypot network. CISA stated it had not observed exploitation at the time of its October 21 alert, and neither CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of this publication. Given the public availability of technical details, Pax8 recommends treating all unpatched, Internet-facing PHP servers as actively targeted.
What’s my risk?
You are at risk if you or your customers run any PHP installation that serves web requests on a version older than the fixed releases listed below. This includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, on both Linux and Windows servers. The PHP security team considers the risk highest for Apache with mod_php, where a demonstrated exploit can be triggered by an unauthenticated request before any application code runs. PHP’s source analysis indicates PHP-FPM, FrankenPHP and LiteSpeed are also susceptible.
Successful exploitation gives an attacker code execution as the web server account, which can lead to web shell installation, website defacement or malware injection, data theft from databases the application can reach, and use of the server as a foothold for further attacks.
Multiple Pax8 marketplace vendors have also issued advisory notices sharing their own product exposure or generically advising customers on the same type of information presented here. You should check product websites directly for the most up to date information, but we will link to advisories we’ve received by the time of this publication below.
Common environments to review include:
- Self-hosted customer websites and CMS platforms (WordPress, Joomla, Drupal, Magento, WooCommerce) on VPS, dedicated or on-premises servers.
- Servers managed through hosting control panels such as cPanel/WHM and Plesk, which frequently run several PHP versions side by side.
- On-premises line-of-business, intranet, helpdesk or IT management applications built on PHP, including vendor software and appliances that bundle their own PHP runtime.
- Customer sites on third-party shared or managed hosting. Patching is typically the hosting provider’s responsibility; confirm their remediation status directly.
What products/versions are affected?
- PHP 8.5 prior to 8.5.12
- PHP 8.4 prior to 8.4.27
- PHP 8.3 prior to 8.3.36
- PHP 8.2 prior to 8.2.35
- PHP 8.1 and older. These branches are end-of-life and will not receive official releases from the PHP project. Ubuntu has issued fixes for packages as old as PHP 5.5, indicating older branches are also affected.
Note on Linux distribution packages: Distributions commonly backport security fixes without changing the upstream version number. For example, Ubuntu 24.04’s patched package is 8.3.6-0ubuntu0.24.04.13, which is fixed despite reporting “8.3.6.” Confirm patch status against your distribution’s security advisory or package changelog rather than the PHP version number alone.
How can I fix this?
1. Update PHP immediately — Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your operating system or panel vendor’s patched package. Prioritize Internet-facing servers and Apache mod_php deployments. Windows source and binaries are available from the php.net downloads page.
2. Use the correct update source for each server — The PHP project provided patches to Linux distributions and LTS vendors in advance, so check your vendor for updated packages:
- Ubuntu 22.04, 24.04, 26.04 and 26.10 receive fixes through standard updates (USN-8948-1). Ubuntu 20.04 and older receive fixes through Ubuntu Pro ESM (USN-8948-2).
- For other distributions (Debian, Red Hat Enterprise Linux and derivatives), refer to the vendor’s security advisory for the fixed package version.
- Hosting control panels such as cPanel and Plesk manage their own PHP builds separately from the operating system. Update panel-managed PHP versions in addition to system packages.
- The PHP project advises users of the volunteer-maintained Remi repository (rpms.remirepo.net) to switch to distribution packages or build from source, as that repository would not have same-day updates.
3. Restart PHP services after updating — Restart Apache, PHP-FPM and any long-running PHP worker processes, or reboot the server. Running processes continue to use the vulnerable code until they are restarted. Systems with automatic updates enabled still require this restart.
4. Verify every PHP version on each host — Servers often have multiple PHP versions installed, and the version reported by the command-line “php -v” may differ from the version serving web traffic. Confirm each installed version and each website’s assigned PHP handler.
5. Address end-of-life PHP versions (8.1 and older) — Obtain a backported fix from your distribution or LTS vendor where available, or upgrade the application to a supported PHP branch. The PHP project has also published minimal source backports for PHP 7.4, 8.0 and 8.1 for those who build from source. The UK NCSC advises considering taking systems offline until they can be fully mitigated if updates or temporary mitigations cannot be applied promptly. Note that PHP 8.2 reaches end-of-life on December 31, 2026, and should be scheduled for upgrade.
6. Contact vendors of bundled software — For appliances and third-party applications that ship their own PHP runtime, check with the vendor for a patched release. NCSC-NL maintains an inventory of software products with a PHP dependency that may be affected (linked below).
7. Apply temporary mitigations only if you cannot update immediately — The PHP project has published configuration changes that reduce exposure to known attack paths but do not fully protect a server. Refer to the PHP security advisory linked below for complete instructions. Key items include:
- CVE-2026-109618: Set memory_limit=-1 in a way applications cannot override (such as php_admin_value in the FPM pool or Apache configuration), and set a low post_max_size (8M if file uploads are not required, 32M if they are). Use container or cgroup memory limits as the availability boundary, not RLIMIT_AS or RLIMIT_DATA.
- CVE-2026-109619: Set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration (not via ini_set() or .user.ini), and restart every worker. On PHP 8.5, also set fatal_error_backtraces=0 and restart every worker.
- Web application firewall (WAF) rules from security vendors may block known exploit techniques, but are a temporary measure and do not replace patching.
- Remove temporary mitigations, particularly memory_limit=-1, once the server has been updated.
8. Review previously exposed servers — The UK NCSC advises assessing unpatched systems for evidence of compromise, including backdoors installed by an attacker, before or alongside remediation. Because CVE-2026-109619 can disclose server memory, consider rotating credentials, API keys and other secrets used by affected web applications.
How are Pax8 systems affected?
Pax8 assessed our internal systems for exposure to CVE-2026-109618 and CVE-2026-109619 and immediately addressed any affected systems. We do not believe Pax8 has any outstanding risk from these vulnerabilities at this time.
Why is Pax8 Notifying Me?
Pax8’s Partner Security Intelligence program monitors high-priority security threats and announcements affecting our Partner community and Marketplace products through a number of trusted sources. We will proactively make Partners aware through bulletins like this one.
Partners are still responsible for assuring the security of their customers’ environments. Pax8 informational messages should be considered an additional data source and not complete coverage of security events and issues.
Where can I learn more about this issue?
The PHP project has published a security advisory with full update and mitigation guidance:
https://www.php.net/archive/2026.php#2026-10-21-5
PHP GitHub security advisory for CVE-2026-109618:
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
PHP GitHub security advisory for CVE-2026-109619:
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
CISA has published an alert for these vulnerabilities:
https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
The UK National Cyber Security Centre has published guidance:
https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
NCSC-NL inventory of software with a PHP dependency that may be affected:
https://github.com/NCSC-NL/php2shell
Ubuntu has published fix availability and update instructions:
https://ubuntu.com/blog/php2shell-vulnerability-fixes-available
BleepingComputer coverage:
https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
Pax8 Marketplace Vendor Notifications
Acronis:
https://security-advisory.acronis.com/advisories/SEC-12305
Sophos:
https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell
Amazon:
https://aws.amazon.com/security/security-bulletins/2026-143-aws/
Please reach out to your Pax8 support team if you have any further questions.
Pax8 Security Advisory: Veeam Backup and Replication (VBR) Vulnerability (CVE-2024-40711)
This Pax8 Security Alert is a notification of a potential security threat for partners who are using Veeam Backup and Replication.
A critical vulnerability with Veeam Backup and Replication requires immediate attention. The exploitation of this Remote Code Execution Vulnerability has been reported and poses a significant threat. The vulnerability was made public in September 2024 and a product version has been released to address this vulnerability. Users of Veeam Backup products are recommended to take action to patch before exploitation occurs.
About this Vulnerability
The vulnerability could potentially allow remote code execution on systems with version 12.1.2 Veeam Backup and Replication, leading to full system compromise.
The technical information related to how this vulnerability has been exploited was noted as, "Each time, the attackers exploited VEEAM on the URI /trigger on port 8000, triggering the Veeam.Backup.MountService.exe to spawn net.exe. The exploit creates a local account, 'point,' adding it to the local Administrators and Remote Desktop Users groups."
Potential Impact
Systems operating on version 12.1.2 are at risk. Attackers could exploit this vulnerability to move laterally within infrastructure, deploy ransomware, or other malicious software.
Recommend Immediate Patching Actions
Pax8 Security team advises patching per the Veeam recommendation for version 12.1.2 of Veeam Backup and Replication and update with version 12.2.
References
Pax8 Security Advisory: OpenSSH Vulnerability (regreSSHion CVE-2024-6387)
This Pax8 Security Advisory is a notification of a potential security threat.
A critical OpenSSH vulnerability requires immediate attention. Remote Code Execution Vulnerabilities are rare but pose a significant threat. The vulnerability has been validated in a lab environment by Qualys and was made public on 1 July 2024. Use this brief window to patch before exploitation begins.
About this Vulnerability
The vulnerability could potentially allow remote code execution on systems accessible over SSH (port 22) as the 'root' user, leading to full system compromise.
Potential Impact
Systems with exposed port 22 are at risk. Attackers could exploit this vulnerability to move laterally within infrastructure, deploy ransomware, or other malicious software.
Recommend Immediate Patching Actions
Pax8 Security team advises patching the following versions of OpenSSH:
- OpenSSH versions before 4.4p1
- OpenSSH versions 8.5p1through but not including 9.8p1
References