TL;DR: Most appliance vendors have shipped php2shell fixes. The remaining exposures linger in devices that will stay vulnerable until someone replaces them.
On October 21, 2026, the PHP project fixed two remote code execution flaws in the PHP core code, tracked as CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 (Critical). Researchers at Calif, working with OpenAI and Wiz, published the details as php2shell. PHP powers web management interfaces on firewalls, application delivery controllers (ADCs), network-attached storage (NAS) devices, and many other devices. The owners of those appliances cannot install the PHP fix themselves. Each vendor compiled PHP into its firmware, so each vendor has to ship a fix. Since our October InfraTrust Pulse captured vendor status on October 24, CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog on October 26. Palo Alto Networks now says attackers are exploiting PAN-OS management interfaces that are exposed to the internet.
Of the 55 vendors in our php2shell tracker, 15 have fixed every product line they list as affected, and 15 say they are not affected. The rest are partly fixed, still investigating, or silent. Several product lines will also never get a fix because they run software past its end of support. To address the long-tail of the php2shell vulnerability, we recommend the following actions:
- Network administration should confirm that no PHP-backed management interface is reachable from the internet and apply the fixed builds.
- Incident response should review any PAN-OS management interface or GlobalProtect portal that was internet-facing while unpatched.
- Infrastructure leadership and procurement should plan to retire or isolate devices with no fix coming.
Palo Alto is the only vendor in our tracker that confirms exploitation of its own products. Seven others say they know of no exploitation, and 33 say nothing either way. Treat each of those statements as accurate on the day it was written, and rank appliances for patching by exposure instead. An appliance whose PHP-backed management interface is reachable from the internet gets patched and investigated first, regardless of what the vendor currently says about attacks.
For PAN-OS, network administration should apply the fixed hotfix for the branch in use. These are the minimum builds Palo Alto lists, and later builds on the same branch also carry the fix:
12.2: 12.2.4-h1
12.1: 12.1.4-h13, 12.1.7-h11, 12.1.10-h3
11.2: 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1
11.1: 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4
10.2: 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12, 10.2.18-h13
On the 11.2.10 branch, Palo Alto’s frequently asked questions note that 11.2.10-h16 covers only the PHP fixes, while 11.2.10-h17 also fixes a separate brotli decompression issue. Then take the management interface off the internet and restrict it to trusted internal addresses, which is the first step in Unit 42’s guidance.
Incident response should treat any PAN-OS management interface or GlobalProtect portal that was reachable from untrusted networks after October 17 as a candidate for compromise review, because patching closes the flaw and does nothing about an attacker who already got in. Palo Alto has not published appliance-specific indicators of compromise, but Dream’s write-up lists what it found on rooted devices:
- A 103-byte PHP web shell at
/unauth/php/change_password.php. PAN-OS ships a legitimate file under that name, so check its size and contents, not just whether it exists - Tunnel scripts under
/usr/local/lib/.panops/, started by a systemd service and anrc.localhook /etc/pam.d/suoverwritten to usepam_permit.so, which lets a local user become root without a password- A reverse Secure Shell (SSH) tunnel to operator infrastructure across eight ports
- Roughly 900 MB of multipart POST traffic with oversized filenames, the shape of the exploit itself
- A SAML configuration with
validate-idp-certificate: no
The SAML setting and the traffic pattern are things your own team can check in the firewall configuration and in network or proxy logs. The file indicators sit on the appliance’s file system, which PAN-OS does not expose through its normal administrative interfaces, so work those checks with Palo Alto support. Unit 42’s hunting query searches next-generation firewall threat logs for Threat ID 543004, which helps only where the relevant Threat Prevention content was installed and logging. Dream also reports that the attacker decrypted an LDAP service account password from a rooted firewall.
If an investigation finds any of these indicators, administrators should rotate every credential stored on that firewall and review where those accounts were used, and incident response should decide with Palo Alto support how to return the device to a trusted state, because a patch alone will not remove the web shell, the tunnel, or the altered login rules.
Some appliances will never get a php2shell fix
A vendor will only rebuild PHP into firmware versions it still supports. For product lines past end of support, or running a PHP branch the PHP project stopped patching, the vendors in our tracker have said one of three things: no fix is listed, the only remedy is a mitigation, or the answer is to migrate. For these devices, the decision belongs to infrastructure leadership and procurement because the remedy is replacement or an upgrade to a supported line. This requires budget approval and a change window to replace a device rather than a patch ticket. Until the replacement happens, network administration should isolate each device’s management interface to trusted administrator hosts.
| Vendor and advisory | Product line | What the vendor says | Remedy |
| NetScaler (CTX697263) | NetScaler ADC and Gateway 13.0 | No fixed build is listed for 13.0. Eclypsium’s lab found PHP 7.3.7 serving the 13.0 management interface. | Upgrade to 13.1-64.32 or 14.1-73.49 or later |
| Check Point (sk1000302) | Firewalls R80 through R81, and Spark R77.20.x and R80.20.x, all end of support | Affected when Mobile Access Portal, Remote Access virtual private network (VPN) with SSL Network Extender or Security Assertion Markup Language (SAML) authentication, Identity Awareness Captive Portal, UserCheck Portal, or Zero Phishing is in use. No hotfix is listed. | Upgrade to a supported version and apply its hotfix, or turn off those features |
| Synology (Synology-SA-26:14) | PHP 7.3 package; DiskStation Manager (DSM) earlier than 6.2 | The end-of-life PHP 7.3 package gets no fix. DSM earlier than 6.2 gets mitigation only. | Remove PHP 7.3, disable affected packages on old DSM, and move to a supported DSM release |
| ASUSTOR (AS-2026-023) | Legacy PHP 7, 7.3, 7.4, and 8.1 packages; ADM 3.5 and 4.0 | The legacy packages were pulled from App Central. ADM 3.5 and 4.0 get mitigation only. | Remove legacy PHP, use PHP 8.3 or later, and disable the Web Server on ADM 3.5 and 4.0 |
| Ivanti (Endpoint Security guidance) | Endpoint Security | Ships an older, affected PHP and reaches end of life on December 31, 2026. Ivanti recommends migrating. | Migrate |
| Belden (PSIRT-10) | macmon network access control 6.x | No patch. | Upgrade to 7.x and apply its patch |
| HPE (HPESBGN05174) | System Management Homepage | Listed as potentially impacted. HPE’s last release was in April 2023, and it manages only Gen8 and Gen9 ProLiant servers. | Retire |
| Siemens (SSA-166980) | Energy Engage V2.0SP9 | Affected in all versions, with no fix planned. Energy Engage V3.1SP1 is fixed. | Upgrade to V3.1SP1 |
| ShareTech (EDM-261028) | Some older models, not named | No fix. | Ask ShareTech which models, then replace |
A second group is affected with no fix and no date. The most important for network teams is Juniper. JSA112681 says Junos OS, including the J-Web interface and SRX Series releases before 25.2R1, is vulnerable to CVE-2026-109618 but rates it as not exploitable because the condition the flaw triggers is reachable but harmless on Junos. Junos OS is not affected by CVE-2026-109619, and Juniper says SRX does not use PHP starting with 25.2R1. Juniper’s workaround is to disable J-Web or limit it to trusted hosts, which is worth doing regardless, given J-Web’s history with CVE-2023-36845.
Siemens lists AMIS TS, blueplanet 360, and parts of Spectrum Power 4 as affected in all versions, with no fix and no product-specific mitigation in SSA-166980. Netgear lists six Nighthawk router models as affected with no fixed firmware yet in its advisory, and rates the issue medium because PHP is reachable only from the local network or Wi-Fi.
The third group is vendors we could not find a public statement from: A10 Networks, Array Networks, Imperva, Lenovo, NVIDIA networking (Cumulus Linux, NVOS, and the Unified Fabric Manager), Radware, and TP-Link. Huawei published a security notice, but the affected products, workarounds, and updates sit in a carrier-portal advisory that requires a Huawei login. Treat all of these as unknown, not as safe. Vendor management should send each one a written question asking which products ship PHP, which PHP branch, and when a fix or a not-affected statement will be published.
On November 2, JPMorganChase’s Global Technology Leadership Team wrote that “unsupported technology should be treated as a time-sensitive business liability.” php2shell turns that into a concrete list. Every row in the table above names a device that will stay vulnerable until someone pays to replace or upgrade it.
What changed since October 24, and where every vendor stands
F5 shipped fixed BIG-IP builds 21.1.0.4, 17.5.1.11, and 17.1.3.7 on October 23, two days after disclosure, and its K000163821 states plainly which products are not affected. Palo Alto shipped every PAN-OS hotfix on or before the date it had promised on October 23. Netgate and OPNsense had updated PHP in pfSense and OPNsense within days. NetScaler added fixed builds to CTX697263 on October 27, HPE Aruba Networking moved ClearPass from a partial to a full fix in HPESBNW05171, NetApp fixed ONTAP 9 in NTAP-20261021-0021, and Cisco cleared nine products it had under investigation in its advisory.
Our October 24 table also needs three corrections. ASUSTOR’s AS-2026-023 rates its PHP packages Critical and lists fixed builds, which our “not affected, but PHP add-ons can be” row undersold. Fortinet, which our table listed as not affected, added FortiSOAR and FortiSOAR PaaS to the affected products in FG-IR-26-186 on November 5. It rates the issue Medium, 5.3, lists patches for FortiSOAR 8.0.0, 7.6.7, and 7.5.4 with fixed releases 7.6.8 and 7.5.5 still to come, and tells customers on 7.4 and older to migrate. FortiDDoS is still under investigation. Netgear’s advisory now names six affected Nighthawk models where our row only said an advisory existed.
The table below groups the 55 vendors in our tracker by status as of November 2, 2026, updated with the changes we found when we rechecked the open advisories on November 5. A vendor’s status is the status of its least-resolved product line that is still supported, which is why Check Point appears as fixed even though its end-of-support versions in the previous section have no fix. Each vendor name links to its advisory.
| Status | Vendors | What it means |
| Affected, no fix yet (1) | Netgear | At least one supported product is vulnerable, with no fixed release and no date |
| Affected, fix scheduled (2) | Extreme Networks, HP Inc. | A fixed release is announced but not shipped |
| Partially fixed (13) | ASUSTOR, Belden, Cisco, Fortinet, Hillstone Networks, HPE, Huawei, Ivanti, Juniper, ShareTech, Siemens, Synology, TerraMaster (forum post, not a formal advisory) | Fixes exist for some affected products or branches, not all |
| Investigating (2) | SonicWall, Western Digital | No product confirmed affected, with at least one still under review |
| Fixed (15) | Barracuda, Check Point, Dell, F5, HPE Aruba Networking, NetApp, Netgate, NetScaler, OPNsense, Palo Alto Networks, Progress, QNAP, Quest KACE, Sangfor, Ubiquiti | Fixed releases exist for every supported product the vendor lists as affected |
| Not affected (15) | Arista, Axis, Cambium Networks, DrayTek, Forcepoint, LANCOM Systems, MikroTik, Moxa, RUCKUS Networks, Sophos, Stormshield, Supermicro, TrueNAS, WatchGuard, Zyxel | The vendor says none of its products are vulnerable, or that the flawed code cannot be reached |
| No statement (7) | A10 Networks, Array Networks, Imperva, Lenovo, NVIDIA networking, Radware, TP-Link | We found no public statement. Treat as unknown, not safe |
Statuses come from each vendor’s own advisory, read on November 2, 2026, with open items rechecked on November 5, and will keep changing as scheduled fixes ship.
What to do, by owner
The preventive work applies to every organization running these appliances. The compromise review applies only where a vulnerable management interface was reachable by an attacker.
- Network administration owns exposure and upgrades. Confirm that no PHP-backed management interface on a firewall, ADC, VPN gateway, or NAS device is reachable from the internet, and restrict each one to dedicated administrator hosts. Palo Alto’s own scoring shows why this matters: the same flaws rate Critical, 9.2, on an internet-exposed PAN-OS management interface and Medium, 5.2, when management access is limited to a jump box. Then apply each vendor’s fixed build, or its interim fix where that is all that exists.
- Vulnerability management owns tracking. First, do not judge an appliance by its PHP version string. F5 backported both fixes into the PHP that BIG-IP ships, so a fixed BIG-IP still reports PHP 5.4.45, a release the PHP project stopped supporting in 2015. Internet-wide exposure counts have the same limit. Censys counts 4,184,559 hosts running PHP in its php2shell advisory (Update 2, October 23) and calls them potentially vulnerable, because the count rests on detected PHP rather than confirmed patch state, and it does not break out appliances. Use its exposure tracker for scale, and your own appliance inventory for decisions. Second, several fixes have not yet shipped: Hillstone between November 6 and 15, Check Point’s Jumbo Hotfix inclusion on November 11, and Extreme ExtremeControl 26.11.10 and Cisco Ultra-Reliable Wireless Backhaul 26.2.1.9, both targeted for November.
- Vendor management and procurement own the gaps. Send a written question to each vendor in the no-statement group, and ask every appliance vendor for a software bill of materials (SBOM), or at least a list of the open-source components and versions in each firmware release, so the next upstream flaw does not start with a week of guessing. For the product lines with no fix coming, work with infrastructure leadership on a replacement plan and date.
- Incident response owns the PAN-OS review described above and any other appliance whose management interface was exposed while vulnerable and whose logs cannot show what happened. If the review finds unexplained administrator accounts, configuration changes, or files, treat the device as compromised and follow the vendor’s recovery guidance. Upgrading alone does not remove an attacker who is already on the device.
Where Eclypsium fits
Both problems in this post come down to knowing what is inside each appliance and whether it has changed. The Eclypsium Infrastructure Assurance Platform inventories network devices down to firmware version, flags devices running vulnerable or end-of-life software, and reports whether a management interface is exposed. That inventory helps network administration build the exposure list and gives infrastructure leadership the retirement list. For the compromise question, Eclypsium verifies device firmware against known-good baselines from outside the device’s own logging and integrity checks, and can validate a rebuilt device back to a known-good state.
Frequently Asked Questions
Yes, against Palo Alto Networks PAN-OS management interfaces exposed to the internet, according to Palo Alto’s advisory. CISA added CVE-2026-109618 and CVE-2026-109619 to the KEV catalog on October 26. Dream Research reports 25 servers rooted in that campaign. No other appliance vendor in our tracker confirms exploitation of its products.
The sources disagree. Dream Research says the exploited management web server also fronts the GlobalProtect portal, while Palo Alto’s advisory lists the portal as not impacted. Patch the firewall either way, and include an internet-facing portal that was unpatched in your compromise review.
No. Palo Alto said the same thing on October 24 and reported active exploitation by October 29. If the management interface is reachable from the internet, restrict it now and patch as soon as a fix ships.
The vendor compiled its own PHP into the firmware, so only the vendor can ship a fixed build. Some appliances run a PHP branch the PHP project no longer patches at all.
Restrict its management interface to trusted administrator hosts now, and plan its replacement or an upgrade to a supported version. The table in the section on devices with no fix lists the ones we found.
No. It means we could not find a public answer. Ask the vendor in writing.
Check the BIG-IP version instead. F5 backported both fixes, so fixed builds such as 17.5.1.11 still report PHP 5.4.45. See K000163821 for the fixed builds.
Sources
- php2shell research: Calif’s write-up; PHP’s advisories for CVE-2026-109618 and CVE-2026-109619; National Vulnerability Database records for CVE-2026-109618 and CVE-2026-109619
- CISA Known Exploited Vulnerabilities catalog
- Amazon Threat Intelligence: php2shell exploitation prior to public disclosure in MadPot, October 21, 2026
- Palo Alto Networks advisory for CVE-2026-109618 and CVE-2026-109619, last updated October 29, 2026
- Unit 42 threat brief on php2shell, updated October 29, 2026
- The Hacker News: Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces, October 29, 2026
- InfraTrust Pulse, October 2026
- JPMorganChase: 200 days into the frontier, November 2, 2026
- Vendor advisories cited in the body: NetScaler CTX697263, Check Point sk1000302, F5 K000163821, Juniper JSA112681, Synology-SA-26:14, ASUSTOR AS-2026-023, Ivanti Endpoint Security guidance, Belden PSIRT-10, HPE HPESBGN05174, HPE HPESBNW05171, Siemens SSA-166980, ShareTech EDM-261028, Netgear KB 000070960, NetApp NTAP-20261021-0021, Cisco cisco-sa-php-october26-Jj384Daq, Fortinet FG-IR-26-186, Extreme Networks KB 000139710, Huawei security notice; all other vendor statements are linked in the status table
- Juniper J-Web PHP history: CVE-2023-36845
- Eclypsium’s examination of appliances in its lab, October 21, 2026, for the NetScaler 13.0 PHP version
- Dream Research: Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers, October 26, 2026, updated October 29, 2026
- Fragnesia: CVE-2026-46300
- Censys: php2shell advisory (Update 2, October 23, 2026) and php2shell exposure tracker
