SFTP Gateway Support

3.0

PHP2Shell (CVE-2026-109618 / CVE-2026-109619): SFTP Gateway is not affected

TLDR - Quick Summary

What: "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619) are two unauthenticated remote code execution flaws in the PHP runtime (PHP-FPM, mod_php, php-cgi), disclosed October 21, 2026 and fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Affected: None. SFTP Gateway does not include PHP in any form, on any platform.

Action: Nothing to do on your SFTP Gateway servers or containers. If you run PHP elsewhere in your environment, patch it there.

Overview

PHP2Shell is a pair of vulnerabilities in the PHP language runtime itself. A request crafted to a server that executes PHP through PHP-FPM, Apache's mod_php, or php-cgi can run arbitrary code without authentication. Because the flaws are in mainstream press coverage, customers have asked whether SFTP Gateway is exposed.

It is not. SFTP Gateway is a Java application. Its web interface is a set of static files served by nginx. No PHP interpreter, PHP-FPM process, Apache module, or CGI handler is installed, so there is nothing for the exploit to reach.

(Last updated 2026-10-22)

Why SFTP Gateway is not affected

  • The SFTP Gateway service is a Java application running on the Amazon Corretto 21 / OpenJDK 21 runtime.
  • The web interface is pre-built static HTML, CSS and JavaScript served directly by nginx. nginx does not execute PHP unless it is configured to hand requests to a separate PHP-FPM process, and no such process or configuration exists on SFTP Gateway images.
  • No marketplace VM image or container image ships a PHP package or binary.

What we checked

We verified the claim above on October 22, 2026 against the current build sources and the published images, rather than relying on product knowledge alone:

  • Marketplace VM images. The Packer templates and image-setup scripts that build the AWS (Amazon Linux 2023), Azure, Google Cloud and Alibaba Cloud images install the Java runtime, nginx and operating-system tooling only. No php, php-fpm, php-cgi or libphp package is installed by any of them. The only occurrences of the string "php" in the build sources are commented-out example lines in nginx's stock configuration template, which are inactive.
  • Container images. The backend image is built from the Amazon Corretto 21 hardened Alpine base image and the UI image from the nginx hardened Alpine base image. We inspected the published images (thorntech/sftpgateway-backend:3.10.0 and thorntech/sftpgateway-admin-ui:3.10.0) inside a running container: no PHP binary on the PATH, no files named php*, php-fpm*, php-cgi*, libphp* or mod_php* anywhere on the filesystem, no PHP package in the package database, and nginx built without any PHP-related module.

If your own security scanner flags PHP on a SFTP Gateway host, it is reporting something installed outside the product. Check for software you or a third-party agent added after launch.

What to do

No action is required for SFTP Gateway. Apply the PHP vendor fixes to any other systems in your environment that run PHP, such as content-management or web-application servers.

References

← PreviousNext →