The PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619 do not affect the standard Parallels RAS components.
Parallels RAS does not use PHP. The RAS Secure Gateway and the RAS User Portal do not require or run PHP. The RAS User Portal is a Node.js-based web application.
Parallels HALB also does not use PHP. HALB is based on HAProxy and keepalived:
- HAProxy provides the load-balancing functionality.
- keepalived provides high-availability and virtual IP management.
Neither HAProxy nor keepalived uses PHP. Consequently, the PHP2Shell vulnerabilities are not applicable to the standard Parallels RAS Secure Gateway, RAS User Portal, or HALB components.
If a vulnerability scanner reports these CVEs for a RAS component, verify that the finding is not related to another application or service hosted on the same system or associated with the scanned IP address.
Component summary
| Component | Technology | PHP2Shell applicability |
|---|---|---|
| RAS Secure Gateway | Parallels RAS Gateway services | Not applicable. The Secure Gateway does not use PHP. |
| RAS User Portal | Node.js web server | Not applicable. The User Portal does not use PHP. |
| RAS HALB | HAProxy and keepalived | Not applicable. HALB does not use PHP. |
Was this article helpful?
Tell us how we can improve it.