Sign in Subscribe

ONTAP PHP Flaw: Patches Are Out — What to Do Now

NetApp's PHP2Shell advisory now lists fixes on five ONTAP 9 branches. What it says, which release to target, the three workarounds and what to do this week.

ONTAP PHP Flaw: Patches Are Out — What to Do Now

On 21 October 2026, the PHP project fixed two critical flaws known as "php2shell". NetApp opened an advisory the same day. ONTAP 9 fixes now exist on five branches.

What the advisory says

NetApp advisory NTAP-20261021-0021 covers CVE-2026-109618 and CVE-2026-109619, both rated CVSS 4.0 9.2 (critical). Both can lead to unauthenticated remote code execution in PHP.

For ONTAP 9, NetApp states:

  • Only CVE-2026-109618 affects ONTAP 9.
  • An unauthenticated attacker could potentially gain access as the www user, but would be restricted to the PHP jail, which limits the scope of the exploit.
  • The advisory status is still Interim.

ONTAP 9 is the only affected product. ONTAP tools for VMware vSphere 10, SnapCenter Plug-in for VMware vSphere, StorageGRID and Trident are listed as not affected.

Fixed versions

Version 7.0 of the advisory, last updated 25 October 2026, lists these ONTAP 9 fixes:

Branch Fixed release
9.15.1 9.15.1P20HF1
9.16.1 9.16.1P16HF1
9.17.1 9.17.1P11HF1
9.18.1 9.18.1P8HF1
9.19.1 9.19.1P3HF1

9.16.1 and 9.17.1 arrived on 24 October, the other three on 25 October. The advisory lists no fix for branches older than 9.15.1; there, the workarounds below are the published options.

Three workarounds, as NetApp states them

Choose one, based on environment and risk tolerance:

  1. Disable all external web services. Safest and most disruptive: System Manager, REST and ZAPI stop. New SVMs need no extra action.
  2. Enable SAML. Apache then requires authentication before invoking PHP on vulnerable endpoints. NetApp says this greatly limits exposure while System Manager keeps working, but a SAML-authenticated attacker could still reach the affected services.
  3. Disable only the sysmgr and saml web services. Less protection, but REST and ZAPI automation keeps working. The change must be repeated on SVMs created later.

The exact commands are in the advisory. Before option 1, list everything that uses REST or ZAPI against the cluster.

What is known about exploitation

  • NetApp (advisory v7.0): "aware of public discussion of this vulnerability". No ONTAP-specific exploitation is reported.
  • CISA (alert of 21 October, revised 23 October): had not observed successful exploitation in the wild as of publication.
  • Amazon Threat Intelligence (AWS Security Blog, 21 October): recorded an exploitation attempt against its MadPot honeypots on 17 October, four days before disclosure, and more on 21 October. Amazon says it is unclear whether any would have succeeded against real-world systems.

CISA and Amazon describe PHP in general, not ONTAP.

The VMware side

Broadcom KB 459989 states that VCF components do not use PHP and are not affected, listing VCF and VVF components and add-ons in 5.2.4 and 9.1.1. That covers the VMware stack, not the ONTAP array behind it.

What to do now

  • Inventory your ONTAP clusters and their exact release.
  • On 9.15.1 to 9.19.1, plan the matching HF release from the table.
  • On older releases, apply one of the three workarounds and plan an upgrade to a fixed branch.
  • Amazon advises investigating from 17 October: review cluster audit logs from that date.
  • Subscribe to the advisory: while Interim, it can still change.

Five branches are fixed. If your cluster is on one of them, the remaining step is the change window.

Sources

Remy Audibert