# Security Update: PHP2Shell and Your UISP Service > Two critical vulnerabilities in PHP, known together as PHP2Shell, affect the CRM module that Ubiquiti ships with UISP. UISP itself does not use PHP, and nothing else in your Cloud UniFi service does. Until Ubiquiti releases a fixed UISP version, we have restricted the CRM module on every UISP service we host. Your devices, monitoring and the rest of UISP are unaffected, we found no sign of the vulnerability being used, and you do not need to do anything. --- ## What PHP2Shell is On 21 October 2026 the PHP project published fixes for two vulnerabilities in the PHP language itself, tracked as CVE-2026-109618 and CVE-2026-109619. Together they are known as PHP2Shell. They let an attacker run code on a web server that uses an unpatched PHP build, without logging in, and in some cases read data from the server's memory. The fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP has published no fixed releases for older PHP lines. Every PHP build that serves web requests and has not been updated is affected, whatever the application running on it. ## Which part of UISP is affected UISP is built on Node.js and does not use PHP. The CRM module that Ubiquiti ships with every UISP installation is a separate container, and it does use PHP. Ubiquiti builds that container, including its PHP, so only a new UISP release from Ubiquiti can replace it. Every UISP service we host includes that CRM module, whether or not you use the CRM. Its pages, including the client zone and the online payment page, can be reached from the internet without logging in, which is what makes the issue matter. No other part of your Cloud UniFi service uses PHP. We checked every hosting server, our customer portal, login, billing and API services, and our authentication service on 22 October 2026. None of them run PHP. ## What we checked and found On 22 October 2026 we reviewed the CRM module's logs and running processes on every UISP service we host, covering the six days before our change. We looked for the signatures of these attacks: memory exhaustion errors, crashes of the PHP workers, and unexpected programs started by the web server. We found none on any service. ## What we changed on 22 October 2026 On every UISP service we host we switched off the PHP feature that one of the two exploit paths relies on and limited the size of requests that can reach the CRM module. We then applied one of two settings, depending on whether your CRM module holds any client records. ### If your CRM module has no client records We blocked all public access to the CRM module. If you open the **CRM** tab in UISP you will see an access denied page until the fix is in. Nothing else changes, because the CRM module was not in use on your service. ### If your CRM module is in use The CRM module stays available. Billing, the client zone and online payments keep working. Uploading files to the CRM is blocked until the fix is in: CSV imports, attachments on tickets and invoices, logos, plugin uploads and any API call that uploads a file fail with a **415** error. In both cases your devices, monitoring, alerts, backups and everything else in UISP keep working exactly as before. ## When this ends Ubiquiti has not yet released a UISP version with a patched PHP build. We check for one every day. When it is released, we will install it on our own test instance first, confirm that the CRM module's PHP is a fixed version, and then upgrade every UISP service we host within 24 hours. We will then remove the temporary restriction. You do not need to do anything, and we will update this page when it is done. ## Questions and answers ### Can I have my CRM module back now? If your CRM module holds client records, it is already available with only file uploads blocked. If it holds none, we have blocked it until the fix is in, because an unused module is exposure with no benefit. If you need the CRM module before Ubiquiti's release, contact us and we will switch your service to the upload-blocked setting instead. ### Can I upload files to the CRM? Not until the fix is in. Uploads fail with a 415 error. Everything that does not upload a file works as normal. ### Are my devices or monitoring affected? No. Device management, monitoring, alerts and backups do not go through the CRM module. ### Should I change my passwords? We found no sign of the vulnerability being used against your service, so this is not required. If you prefer to be cautious, change your UISP administrator passwords and any CRM API keys. It does no harm. ### Does this affect my USG or other Ubiquiti devices? UniFi consoles, access points, switches and the UniFi Network Application do not use PHP. The USG, USG-Pro-4 and USG-XG-8 run an old PHP build on their local web page, which is normally reachable only from the LAN. Ubiquiti has ended support for the USG and will not fix it. Keep the gateway's local web page off the internet and see [USG gateways and UniFi Network 10.6](../Unifi/usg-end-of-life.md) for the replacement path. ### Where can I read more? The two vulnerabilities are listed in the National Vulnerability Database as [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618) and [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619). The fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. ## How to contact us Use the chat in your customer portal or email support@cloudunifi.com. Please include your UISP hostname.