Security Update: PHP2Shell and Your UISP Service

Two critical vulnerabilities in PHP, known together as PHP2Shell, affect the CRM module that Ubiquiti ships with UISP. UISP itself does not use PHP, and nothing else in your Cloud UniFi service does. Until Ubiquiti releases a fixed UISP version, we have restricted the CRM module on every UISP service we host. Your devices, monitoring and the rest of UISP are unaffected, we found no sign of the vulnerability being used, and you do not need to do anything.

---

What PHP2Shell is

On 21 October 2026 the PHP project published fixes for two vulnerabilities in the PHP language itself, tracked as CVE-2026-109618 and CVE-2026-109619. Together they are known as PHP2Shell. They let an attacker run code on a web server that uses an unpatched PHP build, without logging in, and in some cases read data from the server's memory.

The fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP has published no fixed releases for older PHP lines. Every PHP build that serves web requests and has not been updated is affected, whatever the application running on it.

Which part of UISP is affected

UISP is built on Node.js and does not use PHP. The CRM module that Ubiquiti ships with every UISP installation is a separate container, and it does use PHP. Ubiquiti builds that container, including its PHP, so only a new UISP release from Ubiquiti can replace it.

Every UISP service we host includes that CRM module, whether or not you use the CRM. Its pages, including the client zone and the online payment page, can be reached from the internet without logging in, which is what makes the issue matter.

No other part of your Cloud UniFi service uses PHP. We checked every hosting server, our customer portal, login, billing and API services, and our authentication service on 22 October 2026. None of them run PHP.

What we checked and found

On 22 October 2026 we reviewed the CRM module's logs and running processes on every UISP service we host, covering the six days before our change. We looked for the signatures of these attacks: memory exhaustion errors, crashes of the PHP workers, and unexpected programs started by the web server. We found none on any service.

What we changed on 22 October 2026

On every UISP service we host we switched off the PHP feature that one of the two exploit paths relies on and limited the size of requests that can reach the CRM module. We then applied one of two settings, depending on whether your CRM module holds any client records.

If your CRM module has no client records

We blocked all public access to the CRM module. If you open the CRM tab in UISP you will see an access denied page until the fix is in. Nothing else changes, because the CRM module was not in use on your service.

If your CRM module is in use

The CRM module stays available. Billing, the client zone and online payments keep working. Uploading files to the CRM is blocked until the fix is in: CSV imports, attachments on tickets and invoices, logos, plugin uploads and any API call that uploads a file fail with a 415 error.

In both cases your devices, monitoring, alerts, backups and everything else in UISP keep working exactly as before.

Resolved on 23 October 2026

Ubiquiti released UISP 3.1.70 on 23 October 2026. Its CRM module runs PHP 8.3.36, which includes the fix.

We installed it on our own test instance first and confirmed the fixed PHP version. We then upgraded every UISP service we host within about four hours of the release, and checked each one afterwards: the fixed PHP version, UISP login, the CRM module and device connections.

The upgrade replaced the CRM module, which also removed the temporary restriction described above. The CRM module, the client zone, online payments and file uploads work as normal again. Your UISP settings, CRM data and devices were not changed.

Questions and answers

Can I use the CRM module again?

Yes. Since the upgrade on 23 October 2026 the CRM module is fully available again on every UISP service we host, whether or not it holds client records.

Can I upload files to the CRM?

Yes. File uploads, CSV imports and attachments work again since the upgrade on 23 October 2026.

Are my devices or monitoring affected?

No. Device management, monitoring, alerts and backups do not go through the CRM module.

Should I change my passwords?

We found no sign of the vulnerability being used against your service, so this is not required. If you prefer to be cautious, change your UISP administrator passwords and any CRM API keys. It does no harm.

Does this affect my USG or other Ubiquiti devices?

UniFi consoles, access points, switches and the UniFi Network Application do not use PHP. The USG, USG-Pro-4 and USG-XG-8 run an old PHP build on their local web page, which is normally reachable only from the LAN. Ubiquiti has ended support for the USG and will not fix it. Keep the gateway's local web page off the internet and see USG gateways and UniFi Network 10.6 for the replacement path.

Where can I read more?

The two vulnerabilities are listed in the National Vulnerability Database as CVE-2026-109618 and CVE-2026-109619. The fixed PHP releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

How to contact us

Use the chat in your customer portal or email [email protected]. Please include your UISP hostname.