Is MetaDefender Email Gateway Security (EGS) Affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?
Check Your Version
Based on the product-level security assessment, MetaDefender Email Gateway Security does not contain or use PHP.
Security Assessment: Not Affected
MetaDefender Email Gateway Security is not affected by CVE-2026-109618 or CVE-2026-109619 within the assessed product scope.
Overview
PHP2Shell refers to two security vulnerabilities in the PHP interpreter: CVE-2026-109618 and CVE-2026-109619. Under certain conditions, an affected PHP runtime may allow remote code execution.
Product Assessment
MetaDefender Email Gateway Security does not contain the PHP runtime targeted by these vulnerabilities.
Is Any Action Required?
No EGS-specific patch, hotfix or configuration change is required to address these two PHP vulnerabilities in the assessed product. PHP installed separately as part of another application or service must be assessed independently.
Note: This article addresses only the two CVEs above. It does not assess other vulnerabilities or independently installed third-party software.
Additional Resources
Support
If you have questions about this security assessment or a reported vulnerability finding, please contact OPSWAT Support.
This article was last updated on 2026-10-22.