GFI KerioControl is not affected by disclosed PHP vulnerabilities
GFI KerioControl is not affected by the recently disclosed php2shell vulnerabilities (CVE-2026-109618 or CVE-2026-109619), and no action is required.

On October 21, 2026, the PHP project disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (also known as php2shell). Both can allow unauthenticated remote code execution on servers running vulnerable PHP versions.

We have reviewed our product portfolio, and the following GFI products are not affected:

GFI KerioControl
GFI KerioConnect®
GFI AppManager AI
GFI LanGuard AI
GFI MailEssentials AI
GFI Archiver AI
GFI FaxMaker
GFI ClearView AI

Note: For more details on CVE-2026-109618 and CVE-2026-109619, read the PHP Foundation's announcement.