Mitel php2shell: MISA-2026-0008, Product-by-Product Status
Mitel MISA-2026-0008 revision 6: MiCollab and Border Gateway spared by php2shell, but MiVoice 5000, Advanced Messaging and OpenScape Branch need patching.
Who is affected
- MiVoice 5000: R8.4 and earlier
- MiVoice 5000 Gateways XL, XS, XD: R7.2 and earlier
- MiCollab Advanced Messaging: 9.3 and earlier
- OpenScape Branch and OpenScape SBC: V11R3.4.3 and earlier
- Mitel EX Controller and GX Gateway: V50.2 and earlier
- Mitel Collaboration Management (CMG): R9.4 SP1 and earlier
- MiContact Center Enterprise: 9.8 SP0 FP1 and earlier
- End-of-support products: outside the advisory's scope, so no status and no promised fix
How to fix
Upgrade product by product: SecurityPatch_R8.X_20 for MiVoice 5000, release 9.4 or later for MiCollab Advanced Messaging, V11 R3.4.4 for OpenScape Branch and SBC. The knowledge base articles cited by Mitel sit behind the partner login: demand the remediation plan from your telecom integrator and ask which advisory revision it reflects. Until patched, no admin, voicemail or remote-management interface may stay reachable from the internet. Not affected is not permission to expose.
What happened
Mitel published advisory MISA-2026-0008 on October 22, 2026, tracking the two php2shell flaws in the PHP engine (CVE-2026-109618 and CVE-2026-109619) across its whole catalogue. Six days, six revisions: as of October 28 (revision 6.0) the interim verdict clears most products as Not Affected and confirms several affected ones, including gear that is common in hotels. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) leaves no room for interpretation: network attack, no account, reachable PHP interface.
The two most exposed are spared
The question every hotel IT manager asked when the flaw broke: what about the components that live at the edge, the gateway facing the carrier, the unified communications server? The vendor's answer, identical in revisions 1 and 6: MiVoice Border Gateway Not Affected, MiCollab Not Affected, and the cloud services Mitel operates itself (Unify Phone, CloudLink) clean.
That is not a free pass, for three reasons. First, the affected list includes hardware that is just as often exposed: the MiVoice 5000 appliance, the OpenScape Branch and SBC pair, the EX controller with its GX gateway. Second, for a different flaw family (node2shell, separate advisory MISA-2026-0010), MiVoice Business and MiCollab remain under investigation: two advisories, two vulnerabilities, do not merge them. Third, the public advisory page can serve stale copies: as of this writing, revision 6.0 was still coexisting in cache with revision 1.0, whose matrix differed materially. Ask for the revision number before anyone relays a status.
Who is affected (revision 6.0, October 28)
| Product | Affected versions | Vendor solution |
|---|---|---|
| MiVoice 5000 | R8.4 and earlier | Security update available, SecurityPatch_R8.X_20 |
| MiVoice 5000 Gateways XL/XS/XD | R7.2 and earlier | Planned update |
| MiCollab Advanced Messaging | 9.3 and earlier | Upgrade to 9.4 or later, KB000128990 |
| OpenScape Branch | V11R3.4.3 and earlier | V11 R3.4.4, solution and workaround, KB000128997 |
| OpenScape SBC | V11R3.4.3 and earlier | V11 R3.4.4, solution and workaround, KB000128997 |
| EX Controller and GX Gateway | V50.2 and earlier | Planned update, KB000128981 |
| Collaboration Management (CMG) | R9.4 SP1 and earlier | Workaround available, KB000129022 |
| MiContact Center Enterprise | 9.8 SP0 FP1 and earlier | Solution or workaround, KB000128993 |
Declared Not Affected at revision 6: MiVoice Border Gateway, MiCollab, Mitel Standard Linux, SMB Controller, AG41xx gateways, OpenScape 4000, OpenScape Business, OpenScape Voice Server and InAttend. Vendor caveats: statuses cover supported versions only, and a hotel PBX past end of support gets neither a status nor a fix, which is itself an inventory problem.
What to do
- Get an exact inventory of Mitel products and software versions on site. The label on the box is not enough: the software release determines the status.
- Demand the remediation plan from an authorized Mitel partner. The KB articles cited in the advisory sit behind partner access; the hotel's telecom integrator owes you the upgrade path, product by product.
- Cut public exposure in the meantime: admin interfaces, remote voicemail, remote maintenance. A product Not Affected by php2shell is still attackable through other doors.
- Track the revisions: six in six days as of October 28, and the contact-center section is still open. Check the revision number before acting or reassuring anyone.
- Treat end-of-support gear as a risk of its own: isolate it, replace it, or negotiate coverage, without waiting for a fix that will not come.
Context
php2shell already has its own page on this wire: two flaws in the PHP engine itself, in the CISA KEV catalog since October 26, active exploitation confirmed. Telecom appliances embed PHP for their management interfaces, maintenance portals and web reports. The appliance's software release defines the attack surface, not the hotel's PHP: hence the value of vendor matrices, product by product, revision by revision.
The same care applies to the other flaw family of the fortnight: the Brotli decoder bug CVE-2026-111497, called in turn node2shell, HTTP2Shell or Brotli2Shell, which has its own Mitel advisory (MISA-2026-0010, October 30 revision, OpenScape Endpoint Management affected) and its own dedicated page on this wire. Appliances embed both libraries: php2shell on one side, HTTP2Shell on the other, two inventories, two remediation plans.