PHP2Shell: List of Affected Products

TL;DR

PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, lets unauthenticated attackers run code on servers that use PHP. PHP fixed both flaws on October 21, 2026, but PHP also ships inside firewalls, NAS devices, hosting panels and cloud platforms. This page lists the PHP2Shell affected products confirmed so far, along with each vendor’s patch status.

CVE	CVSS (CVSSv4)	Type	Fixed in	Status	PoC
CVE-2026-109618	9.2	RCE via OOM corruption	8.2.35, 8.3.36, 8.4.27 (+1)	Not exploited	Available (Nuclei)
CVE-2026-109619	9.2	RCE via stale global state	8.2.35, 8.3.36, 8.4.27 (+1)	Not exploited	—

Why It Matters

Attackers moved fast. Amazon Threat Intelligence says “PHP2Shell is now being broadly exploited in the wild,” with the first attempt seen on October 17. Because PHP sits inside many appliances, a server patch alone does not close every gap.

The Dutch NCSC keeps a running inventory in its NCSC-NL PHP2Shell GitHub repository. As of its October 23 update, it tracks about 750 products. Of those, 109 have fixes, 222 are marked vulnerable, 389 are still under investigation and 29 are confirmed not affected.

Upstream PHP fixes

• PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
• PHP 8.1 and older get no official fix, though PHP posted source backports for 7.4, 8.0 and 8.1

Affected Products Without a Released Fix

These vendors confirm their products are affected. In most cases, fixed builds are still pending, so these PHP2Shell affected products need interim mitigations.

Network and security appliances

• Palo Alto Networks: PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2, Panorama, and WildFire WF-500 and WF-500-B. Hotfixes are rolling out branch by branch.
• Cisco: Expressway Series, Expressway Select Series and Ultra-Reliable Wireless Backhaul (URWB). Expressway fix 15.5.21 has no release date yet.
• Citrix: NetScaler ADC and NetScaler Gateway, all supported versions. Exposure is limited to management GUIs.
• F5: BIG-IP 17.1.0-17.1.3, 17.5.0-17.5.1 and 21.1.0, including the Configuration utility and APM page templates.
• Check Point: Force, Spark and Cloud Firewall web interfaces when certain portal or VPN features are on. Jumbo Hotfixes are planned for November 11.
• Broadcom: Carbon Black App Control Server.

NAS and storage

• QNAP: QTS 6.1.0 and 5.2.11 or earlier, QuTS hero h6.1.0, h6.0.x and h5.2.11 or earlier, QuTScloud c5.2.9 or earlier, Note Station 3, QuMagie 2.10.1 or earlier, QNE (ADRA), QVR Surveillance on ARM32, and TVR OS. Details are in QNAP advisory QSA-26-18.
• Synology: the end-of-life PHP 7.3 package.

Hosted services

• Sophos: the MyUTM licensing portal ran an affected PHP version. Sophos took it offline on October 21 for updates.

Products With Fixes Available

Appliances and enterprise software

• Okta Access Gateway: 2026.44.0, with PHP 8.3.36
• Broadcom Symantec Endpoint Protection Manager: 14.3.27716.10000 and 14.4.494.0000
• Tenable Security Center and Enclave Security: patch SC-202610.1
• Checkmk Appliance: 1.7.25
• Netgate pfSense: updated PHP packages for Plus 26.07 and 26.03.1, and CE 2.9.0 and 2.8.1
• OPNsense: Community 26.7.7 and Business 26.4.2p3 PHP hotfixes
• Synology: PHP 7.4 to 8.4 packages and Web Station, per Synology-SA-26:14
• Unraid: OS 7.3.4
• Delta Controls enteliWEB: 4.29 or newer with patch SecB0015
• FileCloud Server: 23.263.2

Hosting control panels

• cPanel & WHM: 11.110.0.153, 11.134.0.66, 11.136.0.50 and 11.138.0.18, plus patched EasyApache 4 PHP builds
• Plesk: Obsidian 18.0.80 Update 11 or 18.0.81 Update 4, plus fixed hosted PHP packages
• DirectAdmin, HestiaCP and aaPanel: patched PHP builds
• CloudLinux and TuxCare: fixed ea-php, Alt-PHP and ELS packages

Linux distributions

Ubuntu, Debian, Red Hat Enterprise Linux 9, SUSE Linux Enterprise, Arch Linux, Gentoo, FreeBSD ports, NixOS and Homebrew have shipped fixed PHP packages. Check your distribution’s security notices for exact builds.

Cloud and managed hosting

Patched runtimes are live on AWS Elastic Beanstalk, Azure App Service for Linux, Google App Engine Standard, Heroku, Laravel Cloud and Vapor, Pantheon, Upsun, Scalingo, Kinsta and WP Engine. In addition, N-able completed fixes across its hosted platforms on October 22. Customers who run their own containers on Cloud Run or App Engine Flexible must rebuild them.

Container images

The Docker Official PHP images, FrankenPHP 1.13.2, Server Side Up v5.0.2, Bref and DDEV have rebuilt images with fixed PHP.

Still Under Investigation

• Cisco: Catalyst Center, Meraki Dashboard, ISE Portal Builder, IoT Control Center, WAN Automation Engine, Unified Industrial Wireless, CX Cloud, Panoptica, Slido and Ultra Cloud Core Converged Policy and Charging
• Fortinet: FortiDDoS, FortiDDoS-F, FortiSOAR, FortiSOAR PaaS and FortiClient Cloud
• Broadcom: CloudSOC CASB and Content Analysis
• Juniper: Junos OS J-Web
• NAS makers: TerraMaster, Ugreen and Asustor

Confirmed Not Affected

• Fortinet: FortiOS, FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiClient, FortiSASE, FortiAuthenticator, FortiSwitch, FortiNAC, FortiADC, FortiSIEM, FortiMonitor and FortiEndpoint
• Palo Alto Networks: Cloud NGFW, Prisma Access, GlobalProtect App, Cortex XDR, XSIAM, XSOAR and Xpanse, Strata Cloud Manager and WildFire Cloud
• Cisco: ISE, Catalyst SD-WAN Manager, Umbrella, Secure Access, Webex, Hypershield, Multicloud Defense and several others
• Sophos: UTM, Firewall and Endpoint
• Paessler: PRTG Network Monitor and PRTG Hosted Monitor

What to Do Now

• Patch PHP everywhere you control it, then restart every PHP worker.
• Apply vendor fixes for appliances as soon as they ship.
• Until then, keep management interfaces off the internet and limit them to trusted IP addresses.
• Hunt for compromise starting from October 17, the earliest known attack date.
• Recheck vendor advisories often, since patch status changes daily.

This list of PHP2Shell affected products reflects vendor statements and the NCSC-NL inventory as of October 25, 2026. We will update it as vendors publish new fixes.