Safran has confirmed that the SecureSync PHP2Shell vulnerability affects the SecureSync 1200 and 2400, VersaSync, NetClock 9400 series and White Rabbit products. Patches are on the way, and there is a short-term step you can take today. This post covers what happened, which products are affected, and what to do until the fixes arrive.
Last updated: October 29, 2026. Safran’s dates are targets and may change, so check Safran’s advisory for the latest.
What is the PHP2Shell vulnerability?
PHP2Shell is the name given to two flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both can allow an unauthenticated attacker to run code on a vulnerable system, and the pair is rated critical (CVSS v4.0 score of 9.2). The PHP project released fixes on October 21, 2026. A public proof of concept and exploitation attempts have since been reported, which is why Safran is treating this as urgent.
Is my SecureSync affected by the PHP2Shell vulnerability?
Safran has confirmed these products are affected:
- SecureSync 1200 and SecureSync 2400
- VersaSync
- NetClock 9400 series
- White Rabbit (WR-Z16 and WR TP-FL)
Safran lists these products as not affected: WROX Option Card, PNT-360, SAS-E, Epsilon Clock EC20S, GSG-7 and GSG-8.
What should you do now?
Safran’s recommended short-term mitigation is to temporarily disable the HTTP and HTTPS services on the device using the command line interface. The steps are in Safran’s advisory.
If you can’t disable the web interface right now, Telnet suggests limiting access to a management VLAN or jump host, and making sure the device is not reachable from the internet. That is our suggestion, not a Safran recommendation, and it is not a substitute for the patch.
Installing the patch is the permanent fix. Check your current software version now so you are ready when it is released.
When will the patches be available?
Safran’s current target dates are below. Safran says these are subject to validation, and download links are still to be provided. Patches will be posted to the Safran Navigation Timing Fileshare.
| Product | Release | Safran target date |
|---|---|---|
| SecureSync 2400 and VersaSync | 1.18 and 1.19.1 | October 30, 2026 |
| SecureSync 2400 and VersaSync | 1.16 and 1.17 | November 2, 2026 |
| SecureSync 1200 and NetClock 94xx | 6.2.0 | November 5, 2026 |
| White Rabbit | Hotfix 5.6.1 | November 6, 2026 |
Before updating, note the version prerequisites: SecureSync 1200 and NetClock 9400 units must be on 6.2.0, and a SecureSync 2400 on 1.19.0 must move to 1.19.1. Updating on its own does not mitigate the issue until the fixed release is installed.
Need a hand?
If you’re not sure which model or software version you have, or you’d like help applying the mitigation or the update, get in touch with Telnet and we’ll help you sort it out. We’re also keeping an eye on Safran’s updates and will pass along any changes.
For a broader look at locking down your time server, see our post on hardening security on your SecureSync.
Source
- Safran Security Advisory: PHP2Shell CVE Fix Plan (published October 28, 2026)
