NETGEAR says two home routers, the RAX28 and the CAX30, include a PHP bug in the local setup page. Someone already on your Wi-Fi could use it. NETGEAR says that page is not open to the internet by default, and it has not seen attacks on these routers. No fixed firmware version is listed yet.
- Status
- No patch yet
- Being attacked?
- Not known[2]
- Severity
- Medium
- Updated
CISA lists the PHP bugs as used in real attacks. NETGEAR says these routers are not open to the internet by default and that it has not seen attacks on them. Severity: NETGEAR rates this Medium. First reported .
Am I affected?
You are affected if your router is a NETGEAR RAX28 or CAX30. The model number is on the label. NETGEAR says other models are not affected. The CAX30 also has a separate October firmware update for a different bug.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| NETGEAR home routers and extenders | Home router | NETGEAR RAX28 and CAX30, all current firmware (no fixed version is listed) | No fixed firmware yet. NETGEAR says this notice will be updated when a version is ready.[1] |
How to check your version
These checks only look. They do not change anything on your computer.
NETGEAR home routers and extenders on Home router
Easy way: Log in to your router (usually routerlogin.net). Look for Advanced > Administration > Firmware Update. Or use the NETGEAR Nighthawk or Orbi app.
How to fix it
- Do not share your Wi-Fi password with people you do not trust.
- Keep the router's admin password to yourself.
- Turn on automatic firmware updates if the router offers them, so a fix can install when NETGEAR publishes one.
- Read the NETGEAR notice again later for a firmware version.
More on each app: Is my NETGEAR router up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/netgear-rax28-cax30-php-no-firmware-fix.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): CVE-2026-109618, CVE-2026-109619
Sources
- MakerNETGEAR: security advisory for PHP bugs in RAX28 and CAX30 (last updated Oct 28, 2026) (Oct 28, 2026)
- CISACISA: Known Exploited Vulnerabilities catalog entries for CVE-2026-109618 and CVE-2026-109619 (added Oct 26, 2026) (Oct 26, 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.