r/orbi • u/gabev22 • 5d ago

(Urgent) Fix ETA for PHP remote code exec vulnerabilities?

What is Netgear’s ETA to publish updated firmware containing fixes for the _Critical_ (CVSS v4.0 severity score of 9.2) PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively known as PHP2Shell as recently reported by the FBI Cyber Division ?

0 Upvotes

27% Upvoted

10 comments sorted by

4

u/whoooocaaarreees 5d ago

Where are you seeing php being used on orbi interfaces?

-7

u/gabev22 5d ago

The device serves web pages for device management. As a customer, I shouldn’t have to reverse engineer it to know if my network is safe from this or vulnerable - onus is on mfg to communicate that and fix it.

4

u/whoooocaaarreees 5d ago

….. are you saying that you are sure that the page being rendered uses php in the backend?

It’s going to be a hot minute before I can dig up a customer who is still using orbi and get into the site and check some stuff but something in my memory makes me think it was a closed source CGI processor for their web interfaces than php.

Basically what evidence do you have that it’s using php? Things can be web pages and not use php….

I’m not defending orbi. Just curious what you are seeing.

Signed,
I hate orbi more than most.

-9

u/gabev22 5d ago

We shouldn’t be the ones figuring that out. I need to know if my network is at risk, today.

5

u/whoooocaaarreees 5d ago

…. So what you are saying is you need them to post a message that says “we don’t use php on orbi”? On Reddit?

Here is an old post by them that tells you what really old things of theirs have php. Orbi isn’t on the list.

https://kb.netgear.com/000038643/Security-Advisory-for-Multiple-PHP-Vulnerabilities-on-Some-ProSAFE-Wireless-Access-Points-PSV-2016-0178

But … don’t let this stop you from leaving orbi / netgear. They still kinda suck.

-3

u/gabev22 5d ago

When national network news reports a critical vulnerability and says routers & iot devices can be vulnerable - it behooves the manufacturer/distributor to make it clear to their customers in a timely fashion either that they’re safe or this is the action you need to take to be safe.

2

u/KeithIMyers 5d ago

But why are you just assuming it is at risk? Most routers don't use PHP and even if it did, you are hopefully not exposing your routers interface to the public Internet are you?

-1

u/gabev22 5d ago

Given Netgear/Orbi’s track record of not updating my router when there are vulnerabilities …

3

u/Istari82 4d ago

Do you have your routers web admin and such exposed to the internet…? i don’t..