Overview

Summary

On 21-Oct-2026 the PHP project disclosed two critical vulnerabilities in PHP core and released fixes. They are known publicly as "PHP2Shell". CVE-2026-109618 is an out-of-memory (OOM) error that can leave request memory uninitialized. CVE-2026-109619 is stale global state that can still point to freed request memory. Both can lead to unauthenticated remote code execution (RCE. Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. 

The Quantum PSIRT is actively assessing the impact on Quantum products. This bulletin will be updated as the investigation continues and concludes. 

Immediate action: Make sure Quantum appliances are not accessible from the Internet. If an appliance or any of its management interfaces can be reached from the Internet, disconnect it from the Internet or shut down the exposed service now. This is the primary industry recommendation for these vulnerabilities, and it applies before any other workaround in this bulletin. 

Impact

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the PHP web worker process, and to disclose memory. One crafted HTTP request can trigger it, before any application code runs. 

Vulnerability Scoring Details

Scores are CVSS v3.1 base scores from NVD. The PHP project (CNA) also published a CVSS v4.0 score of 9.2 (CRITICAL) for both CVEs.

CVE	Score	Vector
CVE-2026-109618	9.8 (CRITICAL)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-109619	9.8 (CRITICAL)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation and Public Announcements

Proof-of-concept exploit code is publicly available, and security researchers have reported early exploitation attempts against internet-facing PHP servers. As of this bulletin, neither CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Quantum is not currently aware of any exploitation of these vulnerabilities against Quantum products. 

References

•     https://nvd.nist.gov/vuln/detail/CVE-2026-109618

•     https://nvd.nist.gov/vuln/detail/CVE-2026-109619

•     PHP Security Advisory GHSA-w8hw-w9fx-j79w (RCE via OOM corruption)

•     PHP Security Advisory GHSA-6wmf-4rv5-p3rp (RCE via stale global state)

•     CVE.org – CVE-2026-109618

•     CVE.org – CVE-2026-109619

• StorNext Unified UI (UUI) on Xcellis Workflow Director (Gen 1, Gen 2, Gen 3) 

• Xcellis Workflow Director running StorNext Appliance (SNA) 5.4.x through 7.0.x (bundled PHP, including StorNext Connect where installed) 

• All Myriad deployments running Unified UI earlier than 1.5.5 

• All H4000 (H4024, H4012, and H4Ke) with Xcellis VM running Unified UI 

• ActiveScale Cold Storage – affected through its Xcellis and Scalar tape library components on the Xcellis component (tape connector) running 7.x.x_ the UUI should be disabled  

• Scalar i3, Scalar i6 and Scalar i6H tape libraries – all versions 

• Scalar i7 RAPTOR tape library – all versions 

For detailed StorNext, Xcellis, H4000 and Myriad information, including how to identify affected systems, see Appendix A.

None

Products Not Affected

Quantum has determined that the following products are not expected to be affected by these vulnerabilities:

Product	Notes
ActiveScale software (P100 / X100 / P200 / X200 / Z200)	PHP is not used.
DXi 4.x (DXi4800 series, DXi9000 series, DXi V5000)	PHP packages are present only as command-line dependencies. No PHP web service is installed or reachable over the network. Vulnerability scanners may still report the installed PHP package; that finding alone does not mean the system is exploitable.
DXi 5.x (DXi T10, DXi9200)	Same as above.
DXi 6.x (DXi T10, DXi9200, DXi V5000)	Same as above.
StorNext software (FSM, metadata controller host, client packages)	PHP is not present on the host.
StorNext GUI (built into StorNext software)	PHP is not present on the host.
StorNext NAS / Appliance Controller	PHP is not used.
FlexSync	PHP is not used.
Scalar i500	Not affected due to use of PHP4.
Scalar i6000	PHP is not used.
SuperLoader 3	PHP is not used.
Scalar Key Manager (SKM)	PHP is not used.
Video Surveillance products: Acuity,USP, SmaprtNVR (sNVR)	PHP is not used.
CatDV	PHP is not used.
H Series (All H2K – H2012, H2024, H2124)	PHP is not used.
F Series	PHP is not used.
Quantum Autonomous Data Management	PHP is not used.
QXS 3/4/5 12G	PHP is not used.

Quantum-Hosted Services

Quantum is remediating the following Quantum-hosted services. No customer action is required.

Service	Status	Target Date
Cloud-Based Analytics (CBA)	Fixed	10/22/2026
MyStorNext	Taken offline; customers should use CBA for licensing. Downloads are available on https://mysoftware.quantum.com	10/27/2026

This table lists the planned remediation for each affected product. Target dates are estimates and may change. "TBD" means a date has not been set at the time of this bulletin.

Product	Affected Versions	Workaround	Permanent Remediation Fix	Fix Target
Xcellis (UUI)	SNA 7.2.4	Disable UUI (Appendix A, 4.1)	Option 1 (recommended): Upgrade to SNA 7.2.6, then apply the UUI 11.2.2.5 patch available on mySoftware.quantum.com under Additional Downloads Option 2: Apply the UUI 10.5.0 patch available on mySoftware.quantum.com under Additional Downloads	30-Oct-2026
Xcellis (UUI)	SNA 7.2.5, 7.2.6	Disable UUI (Appendix A, 4.1)	Apply the UUI 11.2.2.5 patch available on mySoftware.quantum.com under Additional Downloads	30-Oct-2026
Xcellis (UUI)	SNA 7.0.x – 7.2.2	Disable UUI (Appendix A, 4.1)	Upgrade to SNA 7.2.6, then apply UUI 11.2.2.5 patch available on mySoftware.quantum.com under Additional Downloads	30-Oct-2026
Xcellis (PHP / Connect)	SNA 5.4.x – 7.0.x	Disable Connect; remove PHP (Appendix A, 4.2–4.3)	Remove PHP, or upgrade to SNA 7.2.6 then apply 11.2.2.5 patch available on mySoftware.quantum.com under Additional Downloads	30-Oct-2026
Myriad with UUI	Myriad 1.5.4	Disable UUI (Appendix A, 4.1)	Apply UUI patch 1.5.5	30-Oct-2026
Myriad with UUI	Myriad 1.5.1	Disable UUI (Appendix A, 4.1)	Upgrade to Myriad 1.5.4, then apply UUI patch 1.5.5	30-Oct-2026
H4000 (UUI)	SNA7.x.x	Disable UUI (Appendix A, 4.1)	Upgrade to SNA 7.2.6, then apply UUI 11.2.2.5 patch available on mySoftware.quantum.com under Additional Downloads	30-Oct-2026
Scalar i3	All	Keep within firewalled data center network	Library firmware 351	11-Nov-2026
Scalar i6	All	Keep within firewalled data center network	Library firmware 351	11-Nov-2026
Scalar i6H	All	Keep within firewalled data center network	Library firmware 351	11-Nov-2026
Scalar i7 RAPTOR	All	Keep within firewalled data center network	Library firmware 141	06 Nov \-2026
ActiveScale Cold Storage	All	Apply the Xcellis (Disable UUI (Appendix A, 4.1)) and Scalar tape library workarounds	Apply the Xcellis and tape library fixes above	Per component

PHP's guidance is that upgrading PHP is the only complete vulnerability resolution. Until those upgrades are available, Quantum recommends these interim mitigations: 

Step 1 – All products: remove Internet exposure (do this first) 

• Make sure no Quantum appliance, management interface or tape library web interface is reachable from the Internet. Do not assume a system is isolated; confirm it with your network or security team by checking firewall, NAT and port-forwarding rules. 
• If any system is reachable from the Internet, disconnect it from the Internet or shut down the exposed service immediately, before applying the product-specific steps below. 
• Quantum products should never be Internet-facing. Block all incoming connections from the Internet by default. SMB file services in particular must never be exposed to the Internet under any circumstances. 

StorNext / Xcellis / QBSP / Myriad

Quantum recommends these immediate steps.  

• After completing Step 1, Disable Unified UI (UUI). The StorNext GUI is not affected and can still be used to manage the system. 

• Disable StorNext Connect if it is installed. Refer to Appendix A: 4.2 

• On Xcellis systems running SNA 5.4.x through 7.0.x, remove PHP (Appendix A, Section 4.3). 

• These steps disable management interfaces only. StorNext file system operation, client access and data path performance are not affected. 

• After installing the SNA 7.2.6 (UUI 11.2.2.5) or Myriad fix, follow the release instructions so the UUI application volumes are repopulated. This removes any changes made to the UUI application before the fix. 

Appendix A gives the system identification checks (Section 3), step-by-step procedures (Section 4) and rollback steps (Section 7). Appendix A also describes an alternative for customers who must keep UUI running: restricting access to the UUI management ports. 

ActiveScale Cold Storage

•     Apply the Xcellis and Scalar tape library workarounds above to the Cold Storage components.

Scalar i3 / i6 / i6H / i7

•     Until the firmware update is installed (Scalar i7 RAPTOR: firmware 141; Scalar i3, i6 and i6H: firmware 352), keep the library inside a firewalled data center network. Allow access to the library web management interface only from trusted administrative hosts, and do not expose it to general-purpose or internet-facing networks.

Customers with a current support contract can get hotfixes, firmware updates and Knowledge Base articles from Quantum Support (https://quantum.com/serviceandsupport/get-help) or by contacting Quantum Technical Support. Customers without a support contract should contact their Quantum sales representative or authorized reseller.  

Contact Quantum Technical Support with questions about this bulletin or about applying a fix. Have the system serial number ready. Regional phone numbers are listed in Appendix A, Section 10. To report a security vulnerability in a Quantum product, contact Quantum Support. 

Interim. Quantum will update this bulletin as investigation of the products listed under Products Under Investigation is completed, and as fixes become available.  This bulletin is posted at https://www.quantum.com/en/service-support/security-bulletins.  Any copy of this notice that omits the URL is uncontrolled and may lack important information or contain factual errors.

This document is provided solely for informational purposes. All information is based upon Quantum's current knowledge and understanding of the hardware and software products tested by Quantum, and the methodology and assumptions used by Quantum. Quantum is not responsible for any errors or omissions that may be contained herein, and no warranty, representation, or other legal commitment or obligation is being provided by Quantum. Target dates are estimates and are subject to change. 

This appendix contains the StorNext product security bulletin (SecurityBulletin_StorNext_PHP2Shell_RevA). It gives detailed identification, mitigation, remediation and rollback steps for Xcellis, QBSP and Myriad. The remediation target dates have been aligned with the main bulletin. 

PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

Mitigation and Remediation Guidance for Xcellis, QBSP and Myriad

CVE	CVE-2026-109618, CVE-2026-109619 ("PHP2Shell")
Severity	Critical – CVSS v4.0 9.2
Category	Third-party component (PHP) / Appliance management interface
Status	Mitigation available; permanent fix in progress

 

What you need to do now Remove Internet exposure first: make sure the appliance is not accessible from the Internet. If it is, disconnect it or shut down the exposed service now (Section 4.0). Identify your system using the checks in Section 3 (about 5 minutes, run as root). Apply the mitigation sections that apply to your product and version (see the table in Section 2). Install the permanent fix when it becomes available, then re-enable UUI. No reboot is required. Only management interfaces are affected. File system operation, client access and data path performance are expected to continue normally.

1. Summary

Quantum has identified that appliance management components on some Xcellis, QBSP and Myriad systems include PHP versions affected by CVE-2026-109618 and CVE-2026-109619, known together as "PHP2Shell". These vulnerabilities allow an unauthenticated remote attacker to execute code through a single network request to an affected PHP service. 

The affected components are the Unified User Interface (UUI) management containers and, on older releases, StorNext Connect and PHP installed on the appliance. The StorNext file system, its data path and StorNext clients are not affected. 

The PHP project released fixed versions (8.2.35, 8.3.36, 8.4.27, 8.5.12) on October 21, 2026, and public exploit code is circulating. Quantum recommends that customers apply the mitigation in this bulletin immediately and install the permanent fix when it becomes available. 

2. Affected Products

Applies to: 

• Xcellis Workflow Director (XWD) Gen 1, Gen 2 and Gen 3 running StorNext Appliance (SNA) 5.4.x through 7.2.x 

• QBSP with H4000 (H4K) running UUI 

• Myriad with UUI 

Which mitigation sections apply to you

Product	StorNext version	Affected component	4.1 Disable UUI	4.2 Disable Connect	4.3 Remove PHP
XWD (all generations)	5.4.x – 6.x	StorNext Connect; PHP on appliance	—	Required	Required
XWD (all generations)	7.0.x	UUI containers; StorNext Connect and PHP if Connect was installed before upgrade	Required	If Connect present	If PHP installed
XWD (all generations)	7.1.x – 7.2.x	UUI containers	Required	—	—
H4000	7.0.x – 7.2.x	UUI containers	Required	—	—
Active Scale tape Connector	7.x	UUI containers	Required	—	—
Myriad with UUI	N/A	UUI containers	Required	---	N/A

Not affected (these products do not use PHP): StorNext file system software (metadata controllers and SAN/LAN clients), FlexSync, Appliance Controller and VS/USP.

UUI failover configurations (two nodes): run Section 4.1 once on the active node; the change applies to both nodes.

3. Identify Your System

For Xcellis systems, determine the installed StorNext version and which affected components are present. Run all commands as root.

Check 1  Find the StorNext version

cat /opt/DXi/version_info

Example output for a system running StorNext 7.2.4:

Major=7

Minor=2

Patch=4

Version=7.2.4-24490

Check 2  Is UUI running?

docker service ls | grep -E 'quantum_(usbe|log_service|usui)'

→ If services are listed, UUI is present. Apply Section 4.1.

Check 3  Is StorNext Connect running?

systemctl list-units --type=service --all | grep -Ei 'connect|httpd|php-fpm | grep -Ei 'connect|httpd|php-fpm|supervisord'

→ If any of these host services are listed, Connect is present. Apply Section 4.2. (UUI runs its PHP inside Docker containers, which do not appear in this list.)

Check 4  Is PHP installed on the appliance?

rpm -qa | grep -i php

→ If packages are listed, apply Section 4.3 after completing Section 4.2.

4. Mitigation Procedures

Before you start Each procedure first saves the current state to /scratch/saved/ so it can be rolled back (see Section 7). Upgrading between StorNext versions, or redeploying UUI, may restart the UUI services. Re-check Section 4.1 after any upgrade until the permanent fix is installed. Upgrading from SNA 7.0.x to 7.1.0 or later removes StorNext Connect.

4.0 Remove Internet exposure (all products – do this first) 

Applies to: All affected products, including Xcellis, QBSP with H4K, Myriad, ActiveScale Cold Storage and Scalar tape libraries 

Why: Disconnecting affected systems from the Internet is the primary industry recommendation for these vulnerabilities. Quantum appliances should never be Internet-facing, and SMB file services must never be exposed to the Internet. 

Step 0a  Confirm that no inbound Internet access exists 

With your network or security team, check that no firewall, NAT or port-forwarding rule allows inbound connections from the Internet to the appliance. This includes the UUI ports (441, 416, 8443, 8445, 8085), web ports (80, 443) and SMB (445). 

Step 0b  Remove any Internet exposure now 

If inbound Internet access exists, remove it. If that cannot be done immediately, disconnect the appliance from the Internet or shut down the exposed service until it can. 

Expected result: The appliance and its management interfaces are reachable only from trusted internal administration networks. Block all incoming Internet connections by default going forward. 

4.1 Disable UUI

Applies to: SNA 7.0.x – 7.2.x, QBSP with H4K, RYO UUI  

Impact: UUI management features (dashboards, alerts, logs, node and client management) are unavailable while UUI is disabled. StorNext file system operation is not affected.

Step 1a  Disable UUI Autostart

/opt/quantum/uui-common/bin/uui autostart disable

Step 1b  Stop the UUI and all services

/opt/quantum/uui-common/bin/uui stop

Step 1c  Verify

/opt/quantum/uui-common/bin/uui status

Expected result: Each UUI service will show stopped and UUI autostart disabled.

Step 1d  Optional: functional check from another host on the network

curl -sk -o /dev/null -w '%{http_code}\n' https://<xcellis-ip>:441/

curl -sk -o /dev/null -w '%{http_code}\n' https://<xcellis-ip>:8445/

Expected result: Both commands return 000 (no connection). Any other HTTP code means a UUI service is still reachable.

After upgrades: an upgrade, reboot-triggered redeploy or UUI redeploy may restart these services. Repeat steps 1a-1c after any such event until the permanent fix is installed.

Alternative – if UUI must remain in service Restrict access to UUI management ports 441, 416, 8443, 8445 and 8085 to trusted administration hosts. Standard host firewall rules do not block these ports because Docker publishes them; follow the procedure in KB KA-03271

4.2 Disable StorNext Connect

Applies to: SNA 5.4.x – 7.0.x

Impact: StorNext Connect management is unavailable while disabled. (StorNext Connect is not included in SNA 7.1.0 and later.)

Step 2a  Record the current service state

systemctl list-units --type=service --all | grep -Ei 'connect|httpd|php-fpm' > /scratch/saved/connect_services.orig

Step 2b  Stop and disable the Connect services

systemctl stop quantum_supervisord httpd php-fpm

systemctl disable quantum_supervisord httpd php-fpm

Step 2c  Verify

systemctl list-units --type=service | grep -Ei 'supervisord|connect|httpd|php-fpm'

Expected result: No Connect, httpd or php-fpm service is active.

Step 2d  Optional: functional check

From another host, try to open the StorNext Connect web page. If the mitigation is active, the connection fails.

4.3 Remove PHP

Applies to: Xcellis running SNA 5.4.x – 7.0.x

Important Complete Section 4.2 first. Removing PHP from the host OS affects StorNext Connect only on older releases: SNA 5.4 up to (but not including) 6.2.0: Connect runs on the host OS. Removing PHP disables Connect on the appliance. If the system is later upgraded to 6.2.0 or later, Connect returns, running in a container. SNA 6.2.0 through 7.1 (where Connect is still installed): Connect runs in a container. Removing PHP from the host OS does not affect the Connect container.Removing PHP from the host OS also does not affect PHP inside the UUI containers. Section 4.1 covers the UUI.

Step 3a  Record installed PHP packages

rpm -qa | grep -i php | tee /scratch/saved/php_packages.orig

Step 3b  Remove PHP

yum remove '*php*'

yum remove PHPUpgrade

Review the transaction summary before confirming. If it lists any Quantum or StorNext package other than PHP and StorNext Connect components, answer N and contact Quantum Support.

Step 3c  Verify

rpm -qa | grep -i php

which php php-fpm

Expected result: No PHP packages are listed and no PHP binary is found.

5. Permanent Remediation

Quantum is preparing UUI 10.5.0 and UUI 11.2.2.5 and a Myriad fix 1.5.5, which replaces the affected PHP containers with patched versions. StorNext 7.3.0 will include the fix. The target availability dates are current estimates and will be confirmed or revised in future revisions of this bulletin. 

Product	StorNext version	Permanent remediation	Target availability
XWD	7.2.4 (including UUI failover)	Option 1 (recommended): Upgrade to SNA 7.2.6, then apply UUI 11.2.2.5 patch available on mySoftware.quantum.com under Additional Downloads Option 2: Apply UUI 10.5.0 patch available on mySoftware.quantum.com under Additional Downloads	October 30, 2026
XWD	7.2.5, 7.2.6 (including UUI failover)	Apply UUI 11.2.2.5 patch available on mySoftware.quantum.com under Additional Downloads	October 30, 2026
XWD	7.0.x – 7.2.2	Upgrade to SNA 7.2.6, then apply UUI 11.2.2.5 patch available on mySoftware.quantum.com under Additional Downloads	October 30, 2026
XWD	5.4.x – 6.x	Disable connect (section 4.2), Remove PHP (Section 4.3), or Upgrade to SNA 7.2.6, then apply UUI 11.2.2.5 patch available on mySoftware.quantum.com under Additional Downloads	October 30, 2026
XWD	UUI 7.3.0	Patched PHP included in release	TBD
H4000	7.x – 7.2.6	Upgrade to SNA 7.2.6, then apply UUI 11.2.2.5 patch available on mySoftware.quantum.com under Additional Downloads	October 30, 2026
Myriad with UUI	N/A	For Myriad 1.5.4 -> Upgrade to Myriad UUI version 1.5.5 For Myriad 1.5.1 -> Upgrade to Myriad 1.5.4 and then apply UUI patch 1.5.5	October 30, 2026

Note: To request access to mySoftware.quantum.com use the appropriate form at https://www.quantum.com/en/service-support/downloads-and-firmware/stornext7/.  

Installing the fix

Installation instructions will be provided with the fix. After the fix is installed, re-enable UUI by verifying services are running, start the service if it's not already running, then enable the auto start, then verify status.

Verify that UUI is running

/opt/quantum/uui-common/bin/uui status

Steps to enable autostart and restart UUI services

/opt/quantum/uui-common/bin/uui autostart enable

/opt/quantum/uui-common/bin/uui start

Confirm the patched PHP version

docker exec $(docker ps -qf name=usbe_php) php --version

docker exec $(docker ps -qf name=log_service_php) php --version

docker exec $(docker ps -qf name=update_service_php) php --version

Expected result: PHP version 8.2.35, 8.3.36 or later.

6. Operational Impact

The mitigations disable management interfaces only. They do not affect:

•     CVFS operation

•     StorNext services

•     Standard client connectivity

•     Data path performance

While mitigated, UUI or StorNext Connect dashboards, alerts, log views and management functions are unavailable. Use the StorNext command line or contact Quantum Support for management tasks during this period.

7. Rollback Procedure

If operational issues occur, revert using the saved state files in /scratch/saved/:

Section	How to revert
4.1 Disable UUI	Re-enable and start the UUI: /opt/quantum/uui-common/bin/uui autostart enable /opt/quantum/uui-common/bin/uui start
4.2 Disable Connect	Run systemctl enable and systemctl start for the services listed in connect_services.orig.
4.3 Remove PHP	Reinstall the packages listed in php_packages.orig (contact Quantum Support).

8. Recommendations

Quantum recommends that customers: 

• Make sure appliances are not accessible from the Internet, and block all incoming Internet connections by default. Never expose SMB services to the Internet. 

• Apply the applicable mitigation sections immediately. 

• Restrict management interfaces to trusted administration networks as standard practice. 

• Install the permanent fix as soon as it is available, then re-enable UUI. 

• Plan upgrades from SNA 5.4.x – 7.1.x to a current StorNext release. 

• Monitor future Quantum advisories for updated remediation guidance. 

9. Additional Notes

Because CVE-2026-109618 and CVE-2026-109619 affect PHP core across all supported branches, customers running other PHP-based applications in their environment should monitor:

•     Operating system vendor advisories and errata for PHP packages

•     PHP project security releases

•     Future Quantum advisories for additional products

References: NVD CVE-2026-109618 · NVD CVE-2026-109619

10. Contact Information

Have your system serial number ready when you call.

Region	Phone
North America	1-800-284-5101
EMEA	Toll free +800-7826-8888 · Direct +49 6131 324 185
Asia Pacific	+800-7826-8887

For additional contact information, go to https://www.quantum.com/en/service-support/