Is Cisco Meraki Affected by PHP2Shell?
Last updated: 24 October 2026
Short answer: No. Meraki MX, MR, MS, MV and the Meraki Dashboard are confirmed not vulnerable to PHP2Shell.
PHP2Shell is the name for two critical remote code execution vulnerabilities in the PHP language itself (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 Critical under CVSS v4.0 by PHP). They affect PHP web servers, not Meraki appliances or the Dashboard.
Cisco’s official position
Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (version 1.6, last updated 23 October 2026 22:39 GMT) lists the following as confirmed not vulnerable:
Meraki Devices
Meraki Dashboard
Meraki MX Security and SD-WAN Appliances
Meraki MR Wireless Access Points
Meraki MS Series Switches
Meraki MV Smart Cameras
Meraki MG Cellular Gateways
Cisco’s advisory states that if a product is not listed, their review indicates it is not affected. Meraki is explicitly listed as not vulnerable.
What this means for you
You do not need to update Meraki firmware or reconfigure Meraki devices for PHP2Shell. The vulnerability is in PHP, and Cisco has confirmed these Meraki products are not vulnerable.
You still need to patch any PHP servers (websites, portals, WordPress, etc.) that sit behind your Meraki MX. Talos has released Snort rules for PHP2Shell (SIDs 67359, 67360 and 67375), and the MX IPS uses Snort with Talos rulesets. However, MX HTTPS Inspection (MX 26.2+, Advanced Security or SD-WAN+ licence) is designed for outbound traffic from managed clients that trust the inspection certificate. It is not documented for inbound HTTPS to your own web servers, so the MX IPS will generally not see inside encrypted requests to an HTTPS PHP site.
For step-by-step FortiGate IPS configuration, see PHP2Shell and How FortiGate IPS Helps Mitigate It.
Frequently asked questions
Does the Meraki Dashboard or any MX need an update for PHP2Shell?
No. Cisco has confirmed Meraki products are not vulnerable.
Can Meraki MX block PHP2Shell exploits to my web servers?
Only with IPS in Prevention mode and the relevant Talos rules active, and in practice only for clear-text HTTP to your servers. Meraki documents HTTPS Inspection for outbound client traffic, not inbound HTTPS to your own servers.
Are any Cisco products affected?
Yes — Expressway, Expressway Select, Ultra-Reliable Wireless Backhaul and Duo Access Gateway are listed as affected, and products such as ISE Portal Builder remain under investigation. No Meraki product is in either list.
Where should I check the latest status?
Cisco Security Advisory cisco-sa-php-october26-Jj384Daq.
Megatron Technology (UEN 199002644W) is an authorised Cisco Networking Partner and Managed Services Provider in Singapore (est. 1990), and a Fortinet reseller. Our 4 Cisco-certified engineers design, licence, procure, deploy and support Cisco Meraki, FortiGate and Cisco enterprise networks. Verify us on the Cisco Partner Locator. Contact: +65 6346 2001 · info@megatron.com.sg.
Sources (checked 24 October 2026):