SFTPPlus MFT is not affected by PHP2Shell

SFTPPlus MFT is not affected by the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. SFTPPlus MFT does not embed PHP or use it to run its file transfer services, Web Manager, or Web Client. No SFTPPlus MFT update or configuration change is required to address these vulnerabilities.

Our documentation site, download site, and product website do not use PHP and are also unaffected by PHP2Shell. The download site runs on SFTPPlus MFT itself.

PHP2Shell refers to two vulnerabilities in PHP request handling that can allow an unauthenticated remote attacker to execute code on an affected server. The PHP project published security fixes on October 21, 2026. See the PHP project's security advisory for affected installations and update guidance.

If you run separate PHP applications alongside SFTPPlus MFT, including custom integrations that execute PHP, assess and update those applications according to the PHP project's guidance. This advisory covers SFTPPlus MFT itself, rather than other software installed on the same server.

If you have questions about your deployment, contact our support team.