AG Neovo is aware of PHP2Shell, a group of critical security vulnerabilities affecting unpatched releases across PHP branches 5.4 through 8.5. Depending on the environment and configuration, these vulnerabilities may allow remote code execution or disclosure of sensitive information.
AG Neovo reviewed NSD Gen 3, Meetboard 4, Meetboard 4 Prime, and AG Neovo-developed software products and their associated server infrastructure to identify affected components and implement appropriate security measures.
Affected Server Components
The review identified the following affected product-related server components:
The AG Neovo official website server was also affected. Its remediation was handled separately, as described below.
Product-Related Servers: Resolution and Mitigation
The following actions were taken for the server environments supporting Neovo Manager API Server, PartnerAppZone API Server, and NSD Gen 3 OTA Server:
| Date | Action Taken |
|---|---|
| October 21, 2026 | Applied temporary security protections based on published security recommendations. |
| October 22, 2026 | Upgraded applicable PHP 8.2 environments to PHP 8.2.35 to address the disclosed vulnerabilities. Full server backup images were created before the upgrade to support recovery if needed. |
| October 23, 2026 | Implemented temporary hardening measures for environments running PHP 8.1 or earlier. |
As part of these temporary hardening measures, the following security configurations were applied to the php.ini files for both the PHP-FPM and CLI environments:
NeoV™ Optical Glass Screen
Anti-Burn-in™ Technologysession.upload_progress.enabled directive was set to 0.post_max_size directive was set to 8M for standard environments and up to 32M for services requiring larger file uploads.upload_max_filesize directive was configured to remain smaller than post_max_size in all applicable environments.Product-related environments updated to PHP 8.2.35 have been patched. For environments running PHP 8.1 or earlier, the temporary hardening measures remain active. These measures reduce exposure to certain attack paths but do not replace a security update; further remediation remains required.
Official Website Server: Resolution
Remediation of the AG Neovo official website server was completed on October 21, 2026, by applying the PHP security update package for Ubuntu 24.04 (Noble).
The php8.3 package was updated to 8.3.6-0ubuntu0.24.04.13.
Ongoing Updates and Customer Guidance
AG Neovo will continue to assess applicable security updates and upgrade options for the product-related server environments that remain under temporary mitigation. This notice will be updated as further remediation is completed or additional guidance becomes available.
Please contact AG Neovo if you have any questions about the affected services or your specific deployment.
Reference
