23 October 2026 – Peplink has released security fixes for the recently published PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which affect InControl Virtual Appliance and Peplink Balance and MAX routers with the Edge Computing feature. Peplink-hosted InControl 2 is not affected.
Affected: InControl Virtual Appliance 2.14.3 and earlier, and Balance and MAX routers with Edge Computing on firmware 8.6.1 GA.
For InControl Virtual Appliance (ICVA) users, firmware 2.14.4 is now available and fixes these vulnerabilities. Updated firmware for Balance and MAX routers with Edge Computing is rolling out now. We recommend that all affected customers update as soon as possible and follow the steps in the security advisory below.
Can’t update yet? The advisory lists simple steps to block outside access in the meantime.
The Peplink team will continue to monitor for possible vulnerabilities and keep customers informed through the Peplink forum and website.