{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "netgear-rax28-cax30-php-no-firmware-fix",
  "url": "https://patchgap.ai/incidents/netgear-rax28-cax30-php-no-firmware-fix/",
  "path": "/incidents/netgear-rax28-cax30-php-no-firmware-fix/",
  "json_url": "https://patchgap.ai/incidents/netgear-rax28-cax30-php-no-firmware-fix.json",
  "title": "NETGEAR RAX28 and CAX30: a PHP bug in the local setup page has no firmware fix yet",
  "category": "network",
  "platforms": [
   "router"
  ],
  "products": [
   "netgear-routers"
  ],
  "status": "no-patch",
  "status_label": "No patch yet",
  "severity": "medium",
  "severity_source": "NETGEAR rates this Medium.",
  "exploited_in_wild": "unknown",
  "exploited_note": "CISA lists the PHP bugs as used in real attacks. NETGEAR says these routers are not open to the internet by default and that it has not seen attacks on them.",
  "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-10-28",
  "updated_at": "2026-11-08",
  "cves": [
   "CVE-2026-109618",
   "CVE-2026-109619"
  ],
  "summary": "NETGEAR says two home routers, the RAX28 and the CAX30, include a PHP bug in the local setup page. Someone already on your Wi-Fi could use it. NETGEAR says that page is not open to the internet by default, and it has not seen attacks on these routers. No fixed firmware version is listed yet.",
  "am_i_affected": "You are affected if your router is a NETGEAR RAX28 or CAX30. The model number is on the label. NETGEAR says other models are not affected. The CAX30 also has a separate October firmware update for a different bug.",
  "action": "RAX28 and CAX30: no firmware fix yet. Keep your Wi-Fi private.",
  "affected": [
   {
    "product": "netgear-routers",
    "product_name": "NETGEAR home routers and extenders",
    "platform": "router",
    "affected_versions": "NETGEAR RAX28 and CAX30, all current firmware (no fixed version is listed)",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "No fixed firmware yet. NETGEAR says this notice will be updated when a version is ready.",
    "fixed_source_urls": [
     "https://kb.netgear.com/000070960/NETGEAR-Security-Advisory-for-PHP2Shell-Vulnerabilities"
    ],
    "check": {
     "menu_path": "Log in to your router (usually routerlogin.net). Look for Advanced > Administration > Firmware Update. Or use the NETGEAR Nighthawk or Orbi app.",
     "command": null,
     "shell": null,
     "read_only": null
    },
    "official_download": "https://www.netgear.com/support/download/"
   }
  ],
  "fix_steps": [
   "Do not share your Wi-Fi password with people you do not trust.",
   "Keep the router's admin password to yourself.",
   "Turn on automatic firmware updates if the router offers them, so a fix can install when NETGEAR publishes one.",
   "Read the NETGEAR notice again later for a firmware version."
  ],
  "official_patch_links": [
   {
    "label": "NETGEAR: PHP notice for RAX28 and CAX30",
    "url": "https://kb.netgear.com/000070960/NETGEAR-Security-Advisory-for-PHP2Shell-Vulnerabilities"
   },
   {
    "label": "NETGEAR: firmware downloads",
    "url": "https://www.netgear.com/support/download/"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://kb.netgear.com/000070960/NETGEAR-Security-Advisory-for-PHP2Shell-Vulnerabilities",
    "title": "NETGEAR: security advisory for PHP bugs in RAX28 and CAX30 (last updated Oct 28, 2026)",
    "date": "2026-10-28",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "title": "CISA: Known Exploited Vulnerabilities catalog entries for CVE-2026-109618 and CVE-2026-109619 (added Oct 26, 2026)",
    "date": "2026-10-26",
    "kind": "cisa",
    "official": true
   }
  ]
 }
}