PHP2Shell: JSA Hotfixes and HPE’s Wider Product Review
The latest HPE and Juniper PHP2Shell assessments lead to several different maintenance decisions. Juniper has published a dedicated JSA hotfix, while its current Junos assessment says the reachable out-of-memory condition is not exploitable. HPE’s wider inventory now includes tape libraries, and its ClusterStor guidance describes separate update routes for two software generations.
These are product-specific findings about the PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. The first concerns invalid request data left during an out-of-memory exit. The second involves internal state surviving after the request memory it refers to has been freed. Neither a shared component name nor a general severity score settles how a particular appliance is exposed.
Read Juniper’s current product row
The 30 October Juniper assessment describes Junos OS as vulnerable to the first flaw but not exploitable: the pre-authentication out-of-memory path is reachable but harmless. It says Junos OS is not affected by the second flaw. SRX stops using PHP from 25.2R1; earlier releases retain the Junos assessment, rather than a statement that every earlier SRX is exploitable.
The named exclusions also include Junos OS Evolved, Session Smart Router, Junos Space, Apstra, Corero SmartWall ONE, Security Director Cloud and Security Director OnPrem. Juniper identifies the affected scope by product, so an exclusion for Session Smart Router should not be extended to the separate Security Threat Response Manager.
For Mist, the listed services and products are Mist Cloud, Wireless Assurance, Wired Assurance, Location Services, Access Assurance, Premium Analytics, Mist Access Points and Mist Edge. The WAN Automation exclusions name Routing Director, Routing Assurance, Routing Active Testing, Paragon Insights and Paragon Pathfinder/Planner. Other products remain under investigation, and Juniper does not evaluate releases beyond End of Engineering or End of Life.
JSA has a separate 30 October hotfix
Security Threat Response Manager, the JSA Series, is listed as vulnerable and fixed by the JSA PHP Vulnerabilities Hotfix. The public download listing shows that hotfix under 7.5.0 with a 30 October file date. That is a distinct package, not evidence that an older service update already contains the correction.
Have the responsible owner match the installed JSA build to the hotfix’s applicability and installation guidance. Record the exact additional package and the resulting state after maintenance. The public listing establishes that a package is offered; it does not prove that a particular deployment has obtained or installed it.
Juniper SIRT says it is unaware of malicious exploitation of this vulnerability. Keep that statement within its vendor and product context. Our wider PHP2Shell report covers confirmed attacks on a different appliance platform. A product-specific assessment cannot establish an absence of exploitation across the entire PHP ecosystem.
HPE’s wider inventory is not a universal patch list
HPE’s general bulletin, updated on 30 October, lists potentially impacted products. These include ClusterStor E1000, E2000 and C500 on 6.x and 7.x; Data Management Framework 7 with DMF_Suite_4.10-rhel810; Assessment Foundry Server_v2.0.2; HP-UX OSP 11.31; and NonStop scripting languages T1203L01-AAO. Potential impact is a prompt for product-specific assessment, not confirmation that every deployment is exploitable.
The 30 October revision adds storage-library entries: MSL 1/8 Gen3 at v1000, MSL2024 Gen4 at v1010, MSL3040 at v3370 and earlier, and MSL6480 at v6.70 and earlier. Preserve the model and version boundaries when reconciling the notice against an asset inventory. A family name alone is insufficient.
System Management Homepage is another listed product, but HPE identifies it as end of life. Its final release dates to April 2023 and supports management of Gen8 and Gen9 ProLiant architectures. Its lifecycle status therefore belongs in the remediation decision alongside exposure and replacement planning.
The bulletin supplies separate resolution links for ClearPass and ClusterStor. It does not provide one corrected version covering the entire inventory. Our ClearPass review explains why its matching additional hotfix and exceptional 6.12.8 route need their own verification. Those packages are not replacements for another product’s correction.
ClusterStor needs both management nodes in scope
HPE’s ClusterStor remediation page separates PHP 8 on ClusterStor 7.x from PHP 7 on 6.x. The 7.x runbook identifies the Rocky Linux 9 package build 8.0.30-8.el9_8.1. The 6.x runbook identifies the Rocky Linux 8 modular build 7.4.33-8.. These are the builds in those procedures, not interchangeable update targets.
Both guides include both management nodes in the package update. They distinguish the active node’s web and monitoring service restart from updating the passive node. They also include a separate session-upload-progress setting and a PHP-FPM restart across the management nodes. The owner needs to account for each of these states, rather than treating one successful package transaction as completion of the whole system.
The guides explicitly say their listed updates do not fix CVE-2026-115560, the separate session-upload-progress issue. They include an additional mitigation and warn that applications using PHP’s built-in upload-progress tracking will lose that progress information, although file uploads continue to work. That is an application-impact decision as well as a security setting.
Verify the correction and the service together
For ClusterStor, the vendor procedures include checking RPM signatures before transfer, confirming package versions on each node, and checking the web interface, monitoring dashboards and logs after maintenance. Retain those observations with the authorised change. A copied package directory and a completed download are preparation records, not proof of the running result.
Keep unresolved product assessments separate from completed fixes. Record the product, branch, source revision, applicable correction and observed result for each asset. Where the vendor is still investigating, preserve that uncertainty and a review point. Where a specific product is excluded, retain the exact scope of that exclusion rather than turning it into an estate-wide all-clear.
