Update - Security update: PHP vulnerabilities (PHP2Shell) – October 23, 2026
This update follows our October 22 notice on PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Since then we have added more protections to the IntelePeer Customer Portal and scheduled the permanent fix.
What changed since our last update
New protections are in place. Last night we turned on additional web security rules designed to block known PHP2Shell attack attempts. These sit on top of the protections we put in place earlier this week.
Portal access is temporarily limited to known locations. To reduce exposure further, the Customer Portal now accepts connections only from internet (IP) addresses that have recently been used to access it. Connections from other addresses will see an access-denied page.
No signs of exploitation. We still see no indication that these vulnerabilities have been used against IntelePeer systems, and we continue to monitor closely.
If you can’t reach the portal
If your team is blocked, please open a ticket with our support team at support@intelepeer.com. We apologize for the inconvenience. This restriction is temporary and will be removed once the permanent fix is in place.
The permanent fix
The upgrade to a patched PHP release is in final testing now. We will deploy it to production as soon as possible once testing is complete. We will confirm here once it’s deployed and the access restriction has been lifted.
Pointers for your own environment
Find any systems you run that use PHP, including third-party applications and appliances.
Apply the PHP development team’s fixes, or your vendors’ patches, as soon as possible.
Until you can patch, limit who can reach affected systems and watch for unusual activity.
If you have questions, please contact support@intelepeer.com.
Oct 23, 2026 - 10:25 EDT
This update follows our October 22 notice on PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Since then we have added more protections to the IntelePeer Customer Portal and scheduled the permanent fix.
What changed since our last update
New protections are in place. Last night we turned on additional web security rules designed to block known PHP2Shell attack attempts. These sit on top of the protections we put in place earlier this week.
Portal access is temporarily limited to known locations. To reduce exposure further, the Customer Portal now accepts connections only from internet (IP) addresses that have recently been used to access it. Connections from other addresses will see an access-denied page.
No signs of exploitation. We still see no indication that these vulnerabilities have been used against IntelePeer systems, and we continue to monitor closely.
If you can’t reach the portal
If your team is blocked, please open a ticket with our support team at support@intelepeer.com. We apologize for the inconvenience. This restriction is temporary and will be removed once the permanent fix is in place.
The permanent fix
The upgrade to a patched PHP release is in final testing now. We will deploy it to production as soon as possible once testing is complete. We will confirm here once it’s deployed and the access restriction has been lifted.
Pointers for your own environment
Find any systems you run that use PHP, including third-party applications and appliances.
Apply the PHP development team’s fixes, or your vendors’ patches, as soon as possible.
Until you can patch, limit who can reach affected systems and watch for unusual activity.
If you have questions, please contact support@intelepeer.com.
Oct 23, 2026 - 10:25 EDT
Monitoring - A fix has been implemented and we are monitoring the results.
Oct 22, 2026 - 12:11 EDT
Oct 22, 2026 - 12:11 EDT
Investigating - This is our latest update on PHP2Shell, the name widely used for two critical security flaws in PHP (CVE-2026-109618 and CVE-2026-109619). PHP is one of the most common programming languages for web applications. Details of the flaws were made public on October 20, earlier than planned, and the PHP development team released fixes the next day on October 21st.
Where things stand today
• Interim protections are in place for both vulnerabilities. Last night our engineering and operations teams updated the affected PHP components and hardened their configuration. These steps cut off the known attack methods while we finish the permanent fix.
• No signs of exploitation. We have seen no indication that these vulnerabilities have been used against IntelePeer systems. We are monitoring the affected systems closely, and our teams are ready to respond right away if anything suspicious appears.
• Additional access controls under review. We are evaluating more restrictions on who can reach the affected systems. Before we make any change, we are checking it against customer integrations so your service isn’t disrupted. If we need anything from you, we will reach out directly.
The permanent fix
The permanent fix is an upgrade to the latest patched PHP release. Our development team is completing the platform changes needed to support that upgrade, and each update will be tested for compatibility and stability before deployment. We expect to share a target completion date shortly and will update you as soon as we confirm it.
Pointers for your own environment
• Find any systems you run that use PHP, including third-party applications and appliances.
• Apply the PHP project’s October 21 fixes, or your vendors’ patches, as soon as they’re available.
• Until you can patch, limit access to affected systems where you can, and watch for unusual activity.
If you have questions, please contact our support team at support@intelepeer.com.
Oct 22, 2026 - 12:10 EDT
Where things stand today
• Interim protections are in place for both vulnerabilities. Last night our engineering and operations teams updated the affected PHP components and hardened their configuration. These steps cut off the known attack methods while we finish the permanent fix.
• No signs of exploitation. We have seen no indication that these vulnerabilities have been used against IntelePeer systems. We are monitoring the affected systems closely, and our teams are ready to respond right away if anything suspicious appears.
• Additional access controls under review. We are evaluating more restrictions on who can reach the affected systems. Before we make any change, we are checking it against customer integrations so your service isn’t disrupted. If we need anything from you, we will reach out directly.
The permanent fix
The permanent fix is an upgrade to the latest patched PHP release. Our development team is completing the platform changes needed to support that upgrade, and each update will be tested for compatibility and stability before deployment. We expect to share a target completion date shortly and will update you as soon as we confirm it.
Pointers for your own environment
• Find any systems you run that use PHP, including third-party applications and appliances.
• Apply the PHP project’s October 21 fixes, or your vendors’ patches, as soon as they’re available.
• Until you can patch, limit access to affected systems where you can, and watch for unusual activity.
If you have questions, please contact our support team at support@intelepeer.com.
Oct 22, 2026 - 12:10 EDT
Communications Automation Platform (CAP)
Operational
Smartflows Automation
Operational
Insights Analytics
Operational
Engage Campaigns
Operational
IntelePeer Portal
Operational
Intelepeer Portal API
Operational
List Management
Operational
AI Hub
Operational
Intelepeer LLM
Operational
Open AI
Operational
Azure Service
Operational
AI Agents
Operational
Smart Messaging Platform
Operational
SMS
Operational
MMS
Operational
10DLC
Operational
SMS API
Operational
Telecom Watchlist
Operational
Verizon Networks
Operational
AT&T
Operational
T-Mobile
Operational
Neustar
Operational
Lumen Toll Free
Operational
Cloud Watchlist
Operational
Deepgram
Operational
Google Services
Operational
Amazon
Operational
IBM WATSON
Operational
test deepgram
Operational
Voice Services
Operational
Chicago Switch
Operational
Dallas Switch
Operational
Denver Switch
Operational
Voice Services Portal
Operational
Switch Number Translations
Operational
Call Authentication API
Operational
CNAM Services
Operational
International Dialing
Operational
Phone Calling (PSTN)
Operational
IntelePeer.com
Operational
MS Teams
Operational
Smart Communicator
Operational
DNS Servers
Operational
VPN Servers
Operational
Infrastructure Component
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance