Legrand confirms Raritan and Server Technology products are not affected by PHP2Shell
What is PHP2Shell?
PHP2Shell is the collective name for two critical vulnerabilities in the PHP language runtime, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. Both can allow an unauthenticated attacker to execute code on a vulnerable server through a crafted web request. The PHP project released emergency patches in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and security researchers have reported early exploitation attempts. If your organisation runs PHP-based web applications, patching those systems should be treated as urgent.
Are Raritan and Server Technology products affected?
Legrand notified partners on 24 October 2026 that it has completed an assessment of the PHP2Shell vulnerabilities across the Raritan and Server Technology portfolios. None of the following products are affected, because they do not use PHP:
- All Raritan KVM and serial products and accessories
- All Raritan rack power distribution and rack management products
- All Server Technology rack power distribution products
- All Legrand sensors, door locks, and other accessories
- All Legrand Open Compute Power System products
Legrand states that no customer action is required for these products in relation to PHP2Shell. Legrand continues to monitor developments as part of its ongoing product security processes and will communicate updates if anything changes.
What should you still check?
While your Raritan and Server Technology hardware needs no action, PHP2Shell affects PHP itself, so any PHP-based tools in your wider environment (web portals, intranet applications, monitoring dashboards built on PHP) should be patched to a fixed PHP version without delay.
Are Raritan intelligent rack PDUs affected by PHP2Shell?
No. Legrand’s assessment confirms all Raritan rack power distribution and rack management products are not affected by CVE-2026-109618 and CVE-2026-109619, because they do not use PHP. Legrand states no customer action is required.
Do I need to patch my Raritan KVM or serial console devices?
Not for PHP2Shell. Legrand’s assessment confirms all Raritan KVM and serial products and accessories are not affected, because they do not use PHP.
What is the fix for systems that do run PHP?
Update to a patched PHP release: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If a system runs a PHP version outside those four branches, check with its vendor or administrator about a fix.
Sources: Legrand partner security notification, 24/10/2026 | Raritan Support | PHP project
Published by
eNOVA Technologies is Singapore's specialist distributor for data centre IT management solutions, representing Adder, Guntermann & Drunck, Raritan, Sunbird, ZPE Systems, and VuWall across Singapore and Southeast Asia. Our technical content is produced with AI assistance and reviewed by our in-house team before publication.
This article was produced with AI assistance and reviewed by the eNOVA Technologies team. All technical claims are verified against manufacturer documentation.
